Documentation

GET /api/auth/callback

Redeem a magic link.

RequestGET /api/auth/callback
AuthenticationCalled by an external provider
Handlerflowfinds-organ/app/api/auth/callback/route.ts

What it does

Consumes the token and redirects. Every outcome is a 302: to the validated `returnTo` on success — which may still carry `?jc=<carrierId>` from before the redirect to sign-in — and to `/login?error=…` otherwise, with distinct messages for an expired link and an invalid one. `POST` answers 405 with `Allow: GET, HEAD`.

Authentication

Called by an external provider. Invoked by a payment or billing provider, or by the browser it redirects.

Parameters

ParameterInTypeRequiredDescription
tokenquerystringRequiredThe token from the emailed link.

Request

The cookie jar carries the session between calls. Angle-bracketed values are the parameter types from the table above.

curl -s -b cookies.txt -c cookies.txt \
  "https://flowfinds.ai/api/auth/callback?token=<string>"
const res = await fetch("https://flowfinds.ai/api/auth/callback?token=<string>", {
  method: "GET",
  credentials: "include",
});
const data = await res.json();
import requests

s = requests.Session()
r = s.get("https://flowfinds.ai/api/auth/callback?token=<string>")
data = r.json()

Recorded example

curl -s -i "$FLOWFINDS_ORIGIN/api/auth/callback?token=…"

Responses

302Always: to `returnTo` on success, to `/login?error=…` on an expired or invalid token.

Errors

StatusReasonWhen
405The method is POST.

Related

Back to the API reference index, or read the cookbook for recipes that compose this endpoint with others.