Back to API Practice

Security/Auth trainer

OAuth Callback API Practice

Practice OAuth callback state, redirect URI validation, PKCE, code exchange, provider errors, token storage, and safe observability.

Start writing test ideasTry API sandbox

How to use this trainer

Choose, send, inspect, write, improve

Safe client-side simulator. No real backend is called and no real data is sent.

  1. 1Choose a preset case
  2. 2Send a simulated request
  3. 3Read the response and QA note
  4. 4Write what you would test
  5. 5Check your coverage

Interactive sandbox

Try the API request

Pick a preset, send a simulated GET /api/auth/oauth/callback request, inspect the fake response, and turn it into test ideas.

OAuth codes and tokens are fake local placeholders only. No real provider is called.

Request

Build the request

GET/api/auth/oauth/callback

Request JSON

application/json
{
  "code": "auth_code_123",
  "state": "state_from_cookie",
  "redirectUri": "https://whattotest.site/oauth/callback",
  "codeVerifier": "pkce_verifier"
}

Test case presets

Choose a case, inspect the fake response, then write what you would test.

Happy path

State / CSRF

Redirect / PKCE

Token exchange

Provider / reliability

Response

Fake API result

Send a simulated request to see status, response JSON, QA note, and what to notice. No real backend is called.

List valid callback, state mismatch, redirect URI validation, PKCE, reused code, provider errors, open redirect, token storage, duplicate callback, mobile deep links, safe logs, and provider outage.

Tip: a stronger answer usually mixes happy path, negative cases, state changes, data, backend, UX, accessibility, and risk.

How to structure your answer

Happy pathNegative casesData rulesSecurity/API risksUX/performance
API ReferenceEndpoint, request fields, responses, and business rulesExpand

API reference

OAuth Callback endpoint

Complete OAuth login by validating callback parameters, exchanging the code, and creating safe session state.

Endpoint

GET/api/auth/oauth/callback

Purpose

Complete OAuth login by validating callback parameters, exchanging the code, and creating safe session state.

Request fields

  • code: authorization code, required
  • state: anti-CSRF state, required
  • redirectUri: exact registered callback URI
  • codeVerifier: required for PKCE clients

Success response

302 Redirect or 200 OK

Request body

{
  "code": "auth_code_123",
  "state": "state_from_cookie",
  "redirectUri": "https://whattotest.site/oauth/callback",
  "codeVerifier": "pkce_verifier"
}

Example response body

{
  "redirectTo": "/dashboard",
  "sessionCreated": true,
  "provider": "github"
}

Errors

  • 400 missing or malformed callback
  • 401 invalid or reused code
  • 403 state mismatch
  • 422 redirect URI mismatch
  • 503 OAuth provider unavailable

Security notes

  • State protects against CSRF/login injection
  • Authorization code is single-use
  • Redirect URI must be exact
  • Codes and tokens never enter logs or analytics

Business rules

  • Valid callback creates session or redirects safely
  • Provider error is shown clearly
  • Duplicate callbacks do not create inconsistent auth state
  • Mobile app callback follows deep-link policy