Sign in with Google or Apple in a browser

GET /v1/auth/{provider}/start

Open it in the browser (a link or redirect, not fetch): it sets a short-lived cookie and redirects to the provider. The provider returns to the callback, which redirects to return_to signed in, or with #mfa_challenge_token=…&methods=… for a second factor, or #error=<code>.

Path

providerstringrequired

one of: google, apple

Query

return_tostring

Where to send the browser afterwards: an absolute URL on the API's origin or an APP_CORS_ORIGINS origin. Default: the API docs

maxLength: 2048

Responses

errors: application/problem+json

302

Found

422

Unprocessable Entity

500

Internal Server Error

503

Service Unavailable

Match errors on the problem's code, which stays the same, not on its message.

Send a request

Server

provider path

return_to query

The request goes from your browser straight to this server; nothing passes through this site. The API must allow this site's origin for CORS.

Requestexample

curl "$API_URL/v1/auth/$PROVIDER/start"

req, err := http.NewRequestWithContext(ctx, http.MethodGet,
	apiURL + "/v1/auth/" + provider + "/start", nil)
if err != nil {
	return err
}
res, err := http.DefaultClient.Do(req)
if err != nil {
	return err
}
defer res.Body.Close()

const res = await fetch(`${apiUrl}/v1/auth/${provider}/start`);

Responseexample

{
  "code": "string",
  "status": 422,
  "title": "Unprocessable Entity",
  "detail": "string",
  "errors": [
    {
      "message": "expected length >= 1",
      "location": "body.name"
    }
  ],
  "request_id": "req_9f86d081884c7d65",
  "type": "string"
}