Finish signing in with a provider

Call this from the page the provider sent the person back to, with the parameters it added to the URL. JSONPad exchanges the code with the provider, then logs in to the identity linked to that account, or creates one and links it. See signing in with a provider.

The API token needs the authenticate permission for the group, and register as well to create identities. The same token that started the sign-in must complete it.

Finishing a sign-in that was started to link an account to an identity uses this endpoint too. The response is then the identity with its linked accounts, and no token.

POST https://api.jsonpad.io/identities/oauth/complete

Example

12345678

curl https://api.jsonpad.io/identities/oauth/complete \
  -H "Content-Type: application/json" \
  -H "x-api-token: <YOUR TOKEN>" \
  -d '{
        "state": "kP1s2JNS2v5HcwHUgFEB0xCT3rMvYGGxYFIYfzSc0lQ",
        "code": "4/0AeanS0b...",
        "clientVerifier": "9mZ0aQvKq2wYd1Yv2s9J6bXQ8xU1nO3pL5tR7uE4iA0"
      }'

Parameters

No parameters

Request headers

required
x-api-tokenstringYour API token.

Request body

{state: "kP1s2JNS2v5HcwHUgFEB0xCT3rMvYGGxYFIYfzSc0lQ"
code: "4/0AeanS0b..."
clientVerifier: "9mZ0aQvKq2wYd1Yv2s9J6bXQ8xU1nO3pL5tR7uE4iA0"
}

required
statestringThe state parameter from the return page's URL.
optional
codestringThe code parameter. Either code or error is required.
optional
errorstringThe error parameter, if the provider sent one instead of a code.
optional
errorDescriptionstringThe provider's error_description.
required
clientVerifierstringThe verifier your app kept when the sign-in started. Its hash must match the one sent then.

Response body

200 OK

The identity, an identity token for it, and whether it was just created. Send the token as x-identity-token from now on, exactly as after logging in.

{id: "609c053d-ea2e-4368-9cda-796d631b86e8"
createdAt: "2026-09-18T20:32:05.464Z"
updatedAt: "2026-09-18T20:32:05.464Z"
group: "sample-group"
name: "google-104829105837261048291"
displayName: "Ada Lovelace"
email: "ada@example.com"
emailVerified: true
hasPassword: false
tags: [
]
lastLoginAt: "2026-09-18T20:32:05.464Z"
activated: true
token: "Ua7Xp1ZtQ0mKcS5hV2nL9bR4wE6yD8gJ"
created: true
}

The identity only has an email if the provider says the address is verified.

Response headers

No response headers

2026-09-17