---
title: "Validate social provider callback REST API | HitKeep"
description: "Reference for the HitKeep REST API operation Validate social provider callback, including request parameters, responses, and authentication notes."
canonical: "https://hitkeep.com/api/operations/apiauthsocialprovidercallback/"
---

# Validate social provider callback REST API

GET

/api/auth/social/{provider}/callback

FetchcURL

```
const url = 'http://127.0.0.1:25737/api/auth/social/google/callback?state=example';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```
curl --request GET \
  --url 'http://127.0.0.1:25737/api/auth/social/google/callback?state=example'
```

-

Consumes the state once, exchanges the code, validates the immutable provider identity and required claims, discards provider tokens, and redirects with a short-lived completion token in the URL fragment. Upstream responses are never exposed.

## Parameters

### Path Parameters

**provider**

required

string

Allowed values: google github microsoft

### Query Parameters

**state**

required

string

**code**

string

**error**

string

## Responses

### 303

Redirects to the bound local flow with a fragment completion token or stable error code

[Previous List social sign-in providers](https://hitkeep.com/api/operations/apiauthsocialproviders/)[Next Start social authentication](https://hitkeep.com/api/operations/apiauthsocialproviderstart/)