Finish signing in with a provider

Where the provider returns the browser. Verifies the ID token (issuer, audience, expiry, nonce, signature) and signs in only a provider-verified email that belongs to an active member, by the same rules as the emailed code. The web app gets a one-time handoff code, never a session token in the URL. The MCP intent issues nothing yet: it shows Scaffold's consent page (the client, the host its code returns to, and the Scaffold account), whose Authorize or Cancel posts to /auth/sso/consent.

GET /auth/sso/{provider}/callback

Path parameters

provider "google" | "microsoft" Required

cURL Node Python

curl -X GET "https://api.scaffoldyourdocs.com/auth/sso/provider_example/callback"

const response = await fetch("https://api.scaffoldyourdocs.com/auth/sso/provider_example/callback", {
  method: "GET",
  headers: {
  }
});

import requests

response = requests.get(
    "https://api.scaffoldyourdocs.com/auth/sso/provider_example/callback",
    headers={
    }
)