Finish signing in with Google
auth.google.callback
GET/api/v1/auth/google/callback
- Route
- Public
Google redirects here; don't call it directly. Creates the session and, for an allowlisted new person, their account, then redirects to the app. On failure the redirect carries sign_in_error: cancelled (the person backed out at Google), google_failed (the request expired or Google rejected it; start again), email_unverified, signup_closed (no account and not on the sign-up allowlist), or not_configured.
Parameters#
| Field | Description |
|---|---|
codequerystringoptional | Authorization code from Google. |
statequerystringoptional | Must match the state set when sign-in started. |
errorquerystringoptional | Error from Google, such as access_denied when the person cancels. |
Response#
302 Redirect to the app, signed in or with sign_in_error. No body.
Errors#
Every error has the same envelope: error.code, error.message, error.details, error.recovery and error.request_id.
| Status | Code | When |
|---|
Examples#
These are real. Each was recorded from a sample household, the Okafors, running through the whole API when this site was built.
Finish signing in
Google sends the browser back with a code. The API starts the session, sets its cookie and redirects to the page the person asked for.
curl 'https://rigel.house/api/v1/auth/google/callback?code=4/0AfJohXnPq2k9sD1eXaMpLe&state=CSDHpd7jP6BjirNhghiJr65Qi4zXC6H9zffQh0fJ8Ko'const response = await fetch("https://rigel.house/api/v1/auth/google/callback?code=4/0AfJohXnPq2k9sD1eXaMpLe&state=CSDHpd7jP6BjirNhghiJr65Qi4zXC6H9zffQh0fJ8Ko");
const data = await response.json();GET /api/v1/auth/google/callback?code=4/0AfJohXnPq2k9sD1eXaMpLe&state=CSDHpd7jP6BjirNhghiJr65Qi4zXC6H9zffQh0fJ8Ko HTTP/1.1
Host: rigel.houseHTTP/1.1 302 Found
X-Request-Id: req_01M6V9CS65TPZGKJQJRKJT08CY
Location: https://rigel.house/family
Set-Cookie: rigel_session=…; Max-Age=2592000; Path=/; HttpOnly; Secure; SameSite=LaxCancel at Google
The person backs out at Google's account chooser. Nothing is created, and the redirect says why.
curl 'https://rigel.house/api/v1/auth/google/callback?error=access_denied&state=cancelled'const response = await fetch("https://rigel.house/api/v1/auth/google/callback?error=access_denied&state=cancelled");
const data = await response.json();GET /api/v1/auth/google/callback?error=access_denied&state=cancelled HTTP/1.1
Host: rigel.houseHTTP/1.1 302 Found
X-Request-Id: req_01M6V9CS6A8YFYSBFJ1W066CE2
Location: https://rigel.house/?sign_in_error=cancelledA Google account that can't sign up yet
Sign-up is limited to an allowlist for now. An account that isn't on it is sent back with signup_closed.
curl 'https://rigel.house/api/v1/auth/google/callback?code=4/0AfJohXnPq2k9sD1eXaMpLe&state=Fao-eg0BLfcR24I3f_NW4DvRO5aAbwi8DABqBQ9vOQ4'const response = await fetch("https://rigel.house/api/v1/auth/google/callback?code=4/0AfJohXnPq2k9sD1eXaMpLe&state=Fao-eg0BLfcR24I3f_NW4DvRO5aAbwi8DABqBQ9vOQ4");
const data = await response.json();GET /api/v1/auth/google/callback?code=4/0AfJohXnPq2k9sD1eXaMpLe&state=Fao-eg0BLfcR24I3f_NW4DvRO5aAbwi8DABqBQ9vOQ4 HTTP/1.1
Host: rigel.houseHTTP/1.1 302 Found
X-Request-Id: req_01M6V9CS6CEDWPVZJWK5ZPNVSE
Location: https://rigel.house/family?sign_in_error=signup_closed