Error
Hosted auth
Finish a social sign-in
Spends the state, exchanges the code with the provider, and resolves the identity onto a contact. The response is the hosted login’s, so an SDK has one shape to handle however somebody signed in.
How the account is resolved, in order:
- A contact already linked to this provider account — resolved by the provider’s subject id, never by the email, so a changed address is still the same person.
- The provider vouched for an address: it links onto the contact that owns it, or creates one. If that contact’s address had never been proven, the password on it had never been proven either — it is removed, every session and outstanding one-time token with it, and the inbox is told. That is the takeover closed: signing up with somebody else’s address and waiting.
- The provider did not vouch: the provider account is the only identity the sign-in carries. The email lands as an attribute and resolves to nothing.
The state is single use, bound to its provider and its environment.
Rate limited to 30 requests per hour per IP.
POST
Error
Parâmetros de caminho
The social provider. google today; adding one is a row and an implementation, never a migration.
Opções disponíveis:
google Corpo
application/json