Loopback authorization-code relay (RFC 8252 §7.3)

GET

/oauth/loopback-callback

const url = 'https://example.com/api/oauth/loopback-callback?state=example';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://example.com/api/oauth/loopback-callback?state=example'

Registered redirect target for CIMD clients whose metadata documents list loopback callbacks. GoTrue validates redirect_uri by exact string match, so at authorize time the proxy forwards this FIXED URL upstream and stashes the client’s validated ephemeral-port loopback target (single-use, 600 s TTL, keyed by state). GoTrue redirects the browser here after consent; this endpoint consumes the stash exactly once and 302s the untouched query string (code/state/iss or the OAuth error triple) to the loopback target. Never redirects anywhere except a loopback http URI validated against the client’s metadata document at authorize time.

Parameters

Query Parameters

state

required

string

Opaque client state — the stash correlation key.

code

string

Authorization code issued by the authorization server.

iss

string format: uri

RFC 9207 issuer identifier, forwarded verbatim.

error

string

OAuth error code, forwarded verbatim on the error path.

error_description

string

OAuth error description, forwarded verbatim.

Responses

302

Redirect to the stashed loopback callback with the query string intact.

Headers

Location

string format: uri

400

invalid_request — state is missing, or no stash entry exists for it (unknown, expired, or already consumed). Deliberately uniform so the endpoint is not a probe for live authorization flows.

application/json

object

error

required

string

Allowed values: invalid_request

error_description

string