Complete plugin OAuth authorization
GET /oauth/callback
Optional plugin-owned target selected by OAuth state.redirectTo; this path is not fixed and is not implemented by the JavaScript template. After the provider redirects to the App Connect extension URI, the browser calls redirectTo with hashedExtensionId and callbackUri. No plugin bearer is intentionally supplied. Shared Axios defaults can nevertheless add ambient RingCentral identity headers and sometimes an App Connect Authorization header; these values are not a supported plugin authentication contract and must not be trusted or logged. The current client interpolates callbackUri without percent-encoding, so fields after its first ampersand can arrive as top-level query parameters. Accept both a correctly encoded URI and the current flattened form, including OAuth errors. Validate the full state and anti-CSRF correlation before code exchange. hashedExtensionId is pseudonymous correlation, not authentication. Any 2xx is treated as success and the body is ignored.
Operation ID: completePluginOAuth
Authorization: None
Parameters
| Name | Location | Type | Required | Description |
|---|---|---|---|---|
hashedExtensionId |
query | string | Yes | Deployment-scoped pseudonymous extension identifier read from App Connect client storage. It can be empty when user metadata is unavailable. Use it only for correlation after validating OAuth state; it is not an authentication credential. |
callbackUri |
query | string · uri | Yes | URI on the App Connect extension redirect page containing the provider result and OAuth state. Correct clients percent-encode the full value. The current client inserts it raw, so this parameter can contain only the prefix before the first ampersand; reconstruct remaining top-level fields before validating state or exchanging a code. |
code |
query | string | No | Provider authorization code that appears as a top-level parameter when it follows the first ampersand in the current client's unencoded callbackUri. Prefer a correctly encoded callbackUri. |
scope |
query | string | No | Provider scope that appears as a top-level parameter when it follows the first ampersand in the current client's unencoded callbackUri. Prefer a correctly encoded callbackUri. |
state |
query | string | No | OAuth state that appears as a top-level parameter when it follows the first ampersand in the current client's unencoded callbackUri. The plugin must reconstruct and validate the complete state. |
error |
query | string | No | Provider OAuth error flattened from the current client's unencoded callbackUri. When present, do not attempt a code exchange. |
error_description |
query | string | No | Provider-supplied error detail flattened from callbackUri. Treat it as untrusted display or diagnostic text and do not echo secrets. |
Responses
| Status | Description | Body |
|---|---|---|
200 |
The provider authorization code was exchanged and stored. The App Connect browser client uses only the successful HTTP status and ignores the response body. | — |
400 |
The callback URI, code, or state was invalid. | — |
500 |
The provider token exchange failed. | — |