Google OAuth callback
curl --request GET \
--url https://api.pid.peridotvault.com/v1/auth/google/callbackconst options = {method: 'GET'};
fetch('https://api.pid.peridotvault.com/v1/auth/google/callback', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.pid.peridotvault.com/v1/auth/google/callback"
response = requests.get(url)
print(response.text)package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.pid.peridotvault.com/v1/auth/google/callback"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"statusCode": 503,
"message": "Google OAuth is not configured. Set GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET (and GOOGLE_CALLBACK_URL) in the env for this environment"
}auth
Google OAuth callback
Handles the redirect back from Google. On success it:
- Returning credential (
provider, providerUserIdalready linked) → issuespid_accessandpid_refreshcookies and redirects (withpid_codewhen the login carried an allowlistedreturnTo). - New credential → mints a single-use claim ticket, sets the
pid_claimcookie, and redirects toCLIENT_SUCCESS_URL?claim=1for the PID picker. Nothing is created untilPOST /auth/claim.
Both cookies are HttpOnly; SameSite=Lax. In production the Secure flag is set.
Strategy/transport failures (stale code, exchange error) redirect to
CLIENT_SUCCESS_URL?error=oauth_failed instead of an error page — the
wallet shows an inline retry. Cause stays in server logs only.
Browser-navigation only. Google redirects the browser here; do not call it
directly via fetch().
GET
/
auth
/
google
/
callback
Google OAuth callback
curl --request GET \
--url https://api.pid.peridotvault.com/v1/auth/google/callbackconst options = {method: 'GET'};
fetch('https://api.pid.peridotvault.com/v1/auth/google/callback', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.pid.peridotvault.com/v1/auth/google/callback"
response = requests.get(url)
print(response.text)package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.pid.peridotvault.com/v1/auth/google/callback"
req, _ := http.NewRequest("GET", url, nil)
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}{
"statusCode": 503,
"message": "Google OAuth is not configured. Set GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET (and GOOGLE_CALLBACK_URL) in the env for this environment"
}Response
Redirect to CLIENT_SUCCESS_URL (or returnTo with pid_code) with session cookies set