Skip to main content

Social OAuth Endpoints

Starts a stateless OAuth flow and completes sign-in through Google, Facebook, Apple, or LINE.

Start OAuth​

  • Endpoint: /api/v1/oauth/{driver}
  • Method: POST
  • Authentication: Partner token.

Supported driver values are google, facebook, apple, and line.

POST /api/v1/oauth/google
Partner-Access-Token: <partner-token>
Accept: application/json
{
  "url": "https://accounts.google.com/o/oauth2/auth?..."
}

Open the returned URL in a browser or popup.

OAuth Callback​

  • Endpoint: /api/v1/oauth/{driver}/callback
  • Method: GET
  • Authentication: Encrypted OAuth state generated by the Start OAuth endpoint.

The provider redirects the browser to this endpoint. It returns an HTML callback view rather than JSON. On success, the view receives:

{
  "success": true,
  "token": "5|sanctum-plain-text-token",
  "data": {
    "id": 42,
    "email": "user@example.com",
    "partner_id": 12
  }
}

On failure, the callback view receives:

{
  "success": false,
  "message": "Unable to authenticate user from OAuth provider."
}

User Resolution Rules​

  • OAuth identities are scoped to the requesting partner.
  • Existing provider links sign in their linked user.
  • For B2B partners, an active user with the provider email must already exist.
  • For other partners, an existing inactive or soft-deleted account is restored and reactivated.
  • If no account exists, a new active user is created and linked to the provider.