Clean callback login
Recommended clean-callback flow. Register a fresh 32-byte base64url session key from your backend and retain it in a browser-bound server session. Navigate the browser to authorization_url. The key and client secret must never appear in URLs. AnyOAuth returns to the exact registered callback without query parameters or fragments on success and failure. No automatic retries.
On this page
https://api.anyoauth.com/v1/login/sessionAuthentication: Client ID and secret in JSON; confidential backend only.
Request
Content type: application/json.
| Field | Type | Required | Description and constraints |
|---|---|---|---|
client_id | string | Yes | minLength: 1; maxLength: 100 |
client_secret | string | Yes | minLength: 1; maxLength: 200 |
session_key | string | Yes | pattern: ^[A-Za-z0-9_-]{43}$ |
provider | "google" | "github" | Yes | |
redirect_uri | string | Yes | Exact registered HTTPS URL or HTTP loopback; no credentials, query or fragment. maxLength: 2048; format: uri; x-validation: redirect |
{
"client_id": "YOUR_CLIENT_ID",
"client_secret": "YOUR_CLIENT_SECRET",
"session_key": "sssssssssssssssssssssssssssssssssssssssssss",
"provider": "google",
"redirect_uri": "https://your-app.example/auth/callback"
}SDK and HTTP examples
import { AnyOAuth } from "@anyoauth/node";
const client = new AnyOAuth({
clientId: process.env.ANYOAUTH_CLIENT_ID ?? "YOUR_CLIENT_ID",
clientSecret: process.env.ANYOAUTH_CLIENT_SECRET ?? "YOUR_CLIENT_SECRET",
baseUrl: process.env.ANYOAUTH_API_ORIGIN ?? "https://api.anyoauth.com",
});
const result = await client.createLoginSession({
sessionKey: process.env.ANYOAUTH_SESSION_KEY ?? "sssssssssssssssssssssssssssssssssssssssssss",
provider: "google",
redirectUri: process.env.ANYOAUTH_REDIRECT_URI ?? "https://your-app.example/auth/callback"
});
@anyoauth/node on GitHubConfidential backend SDK
import os
from anyoauth import Client
client = Client(os.getenv("ANYOAUTH_CLIENT_ID", "YOUR_CLIENT_ID"), os.getenv("ANYOAUTH_CLIENT_SECRET", "YOUR_CLIENT_SECRET"), os.getenv("ANYOAUTH_API_ORIGIN", "https://api.anyoauth.com"))
result = client.create_login_session({"sessionKey": os.getenv("ANYOAUTH_SESSION_KEY", "sssssssssssssssssssssssssssssssssssssssssss"), "provider": "google", "redirectUri": os.getenv("ANYOAUTH_REDIRECT_URI", "https://your-app.example/auth/callback")})
anyoauth-sdk on GitHubConfidential backend SDK
package main
import (
"os"
anyoauth "github.com/AnyOAuth/anyoauth-go"
)
func env(key, fallback string) string { if v := os.Getenv(key); v != "" { return v }; return fallback }
func main() {
client, err := anyoauth.NewClient(env("ANYOAUTH_API_ORIGIN", "https://api.anyoauth.com"), env("ANYOAUTH_CLIENT_ID", "YOUR_CLIENT_ID"), env("ANYOAUTH_CLIENT_SECRET", "YOUR_CLIENT_SECRET"))
if err != nil { panic(err) }
result, err := client.CreateLoginSession(map[string]any{"sessionKey": env("ANYOAUTH_SESSION_KEY", "sssssssssssssssssssssssssssssssssssssssssss"), "provider": "google", "redirectUri": env("ANYOAUTH_REDIRECT_URI", "https://your-app.example/auth/callback")})
if err != nil { panic(err) }
_ = result
}
github.com/AnyOAuth/anyoauth-go on GitHubConfidential backend SDK
<?php
require 'vendor/autoload.php';
$client = new \AnyOAuth\Client((getenv("ANYOAUTH_CLIENT_ID") ?: "YOUR_CLIENT_ID"), (getenv("ANYOAUTH_CLIENT_SECRET") ?: "YOUR_CLIENT_SECRET"), (getenv("ANYOAUTH_API_ORIGIN") ?: "https://api.anyoauth.com"));
$result = $client->createLoginSession(["sessionKey" => (getenv("ANYOAUTH_SESSION_KEY") ?: "sssssssssssssssssssssssssssssssssssssssssss"), "provider" => "google", "redirectUri" => (getenv("ANYOAUTH_REDIRECT_URI") ?: "https://your-app.example/auth/callback")]);
anyoauth/anyoauth on GitHubConfidential backend SDK
import com.anyoauth.AnyOAuth;
import com.google.gson.*;
public class Example {
static String env(String key, String fallback) { String value = System.getenv(key); return value == null ? fallback : value; }
public static void main(String[] args) {
AnyOAuth client = new AnyOAuth(env("ANYOAUTH_API_ORIGIN", "https://api.anyoauth.com"), env("ANYOAUTH_CLIENT_ID", "YOUR_CLIENT_ID"), env("ANYOAUTH_CLIENT_SECRET", "YOUR_CLIENT_SECRET"));
JsonObject params = new JsonObject();
params.addProperty("sessionKey", env("ANYOAUTH_SESSION_KEY", "sssssssssssssssssssssssssssssssssssssssssss"));
params.addProperty("provider", "google");
params.addProperty("redirectUri", env("ANYOAUTH_REDIRECT_URI", "https://your-app.example/auth/callback"));
var result = client.createLoginSession(params);
}
}
com.anyoauth:anyoauth on GitHubConfidential backend SDK
require "anyoauth"
client = AnyOAuth::Client.new(ENV.fetch("ANYOAUTH_CLIENT_ID", "YOUR_CLIENT_ID"), ENV.fetch("ANYOAUTH_CLIENT_SECRET", "YOUR_CLIENT_SECRET"), ENV.fetch("ANYOAUTH_API_ORIGIN", "https://api.anyoauth.com"))
result = client.create_login_session({"sessionKey" => ENV.fetch("ANYOAUTH_SESSION_KEY", "sssssssssssssssssssssssssssssssssssssssssss"), "provider" => "google", "redirectUri" => ENV.fetch("ANYOAUTH_REDIRECT_URI", "https://your-app.example/auth/callback")})
anyoauth-sdk on GitHubConfidential backend SDK
using System;
using System.Text.Json.Nodes;
using AnyOAuth;
using var client = new Client(Environment.GetEnvironmentVariable("ANYOAUTH_API_ORIGIN") ?? "https://api.anyoauth.com", Environment.GetEnvironmentVariable("ANYOAUTH_CLIENT_ID") ?? "YOUR_CLIENT_ID", Environment.GetEnvironmentVariable("ANYOAUTH_CLIENT_SECRET") ?? "YOUR_CLIENT_SECRET");
var result = await client.CreateLoginSession(new JsonObject { ["sessionKey"] = Environment.GetEnvironmentVariable("ANYOAUTH_SESSION_KEY") ?? "sssssssssssssssssssssssssssssssssssssssssss", ["provider"] = "google", ["redirectUri"] = Environment.GetEnvironmentVariable("ANYOAUTH_REDIRECT_URI") ?? "https://your-app.example/auth/callback" });
AnyOAuth.SDK on GitHubConfidential backend SDK
use anyoauth_sdk::*;
use serde_json::json;
fn env(key: &str, fallback: &str) -> String { std::env::var(key).unwrap_or_else(|_| fallback.to_owned()) }
fn main() -> Result<(), Box<dyn std::error::Error>> {
let client = Client::new(&env("ANYOAUTH_API_ORIGIN", "https://api.anyoauth.com"), &env("ANYOAUTH_CLIENT_ID", "YOUR_CLIENT_ID"), &env("ANYOAUTH_CLIENT_SECRET", "YOUR_CLIENT_SECRET"))?;
let result = client.create_login_session(&json!({"sessionKey": env("ANYOAUTH_SESSION_KEY", "sssssssssssssssssssssssssssssssssssssssssss"), "provider": "google", "redirectUri": env("ANYOAUTH_REDIRECT_URI", "https://your-app.example/auth/callback")}))?;
let _ = &result;
Ok(())
}
anyoauth-sdk on GitHubConfidential backend SDK
client = AnyOAuth.new((System.get_env("ANYOAUTH_CLIENT_ID") || "YOUR_CLIENT_ID"), (System.get_env("ANYOAUTH_CLIENT_SECRET") || "YOUR_CLIENT_SECRET"), (System.get_env("ANYOAUTH_API_ORIGIN") || "https://api.anyoauth.com"))
result = AnyOAuth.create_login_session(client, %{"sessionKey" => (System.get_env("ANYOAUTH_SESSION_KEY") || "sssssssssssssssssssssssssssssssssssssssssss"), "provider" => "google", "redirectUri" => (System.get_env("ANYOAUTH_REDIRECT_URI") || "https://your-app.example/auth/callback")})
anyoauth_sdk on GitHubConfidential backend SDK
curl --request POST 'https://api.anyoauth.com/v1/login/session' \
--header 'Accept: application/json' \
--header 'Content-Type: application/json' \
--data-binary @- <<JSON
{
"client_id": "${ANYOAUTH_CLIENT_ID}",
"client_secret": "${ANYOAUTH_CLIENT_SECRET}",
"session_key": "${ANYOAUTH_SESSION_KEY}",
"provider": "${ANYOAUTH_PROVIDER}",
"redirect_uri": "${ANYOAUTH_REDIRECT_URI}"
}
JSON
HTTP reference · keep credentials on your backend
Sample input bindings are illustrative. In a callback handler, take code and transaction values from the validated request and initiating session. Client-only SDKs do not perform confidential exchange.
Response
Success status: 200.
| Field | Type | Required | Description and constraints |
|---|---|---|---|
authorization_url | string | Yes | Exact registered HTTPS URL or HTTP loopback; no credentials, query or fragment. maxLength: 2048; format: uri; x-validation: redirect |
expires_in | 600 | Yes |
{
"authorization_url": "https://api.anyoauth.com/auth/login/aol_lllllllllllllllllllllllllllllllllllllllllll",
"expires_in": 600
}Errors
Application errors use the shared error model. Infrastructure may return non-JSON responses; SDKs expose structured transport/protocol errors. Do not automatically retry a one-time code exchange.
| Field | Type | Required | Description and constraints |
|---|---|---|---|
error | string | Yes | |
message | string | No |
{
"error": "request_failed",
"message": "The request could not be completed."
}Contract source
This page, its field tables and sample inputs derive from OpenAPI version 0.1.0. Download OpenAPI · Download JSON Schema · Request schema · Response schema