API ReferenceEndpointsCustomersHandle o auth callback

Handle o auth callback

Completes a social login. The provider returns the shopper with code and state; this route exchanges them and returns the customer with a session token. A first login creates the account. When the provider returned an error the body carries only error and errorDescription.

GET
/vc/{connectionId}/oauth/{provider}/callback
X-Sales-Channel-Origin<token>

For /api/vc/{connectionId}/* routes the connectionId (vc_*) is in the URL path — not a header. Live-mode requests must also send a matching Origin header.

In: header

Path Parameters

connectionIdstring

Sales channel ID (vc_*), the canonical salesChannelId. connectionId is the deprecated name of the same value and is still the literal path segment.

providerstring

OAuth provider, case-insensitive (google and GOOGLE both work). Only GOOGLE is implemented: FACEBOOK and GITHUB answer 400 (code: provider_unsupported).

Value in"GOOGLE" | "FACEBOOK" | "GITHUB"

Query Parameters

code?string

Authorization code from the provider.

state?string

The state returned by oauth/{provider}/authorize, checked against the stored value.

error?string

Error code the provider sent instead of a code.

error_description?string

Human-readable text for error.

Header Parameters

originstring

Origin of the storefront page making the call, for example https://shop.example.com. Required: a request with no Origin header is refused with 403. On a LIVE channel its host must equal the channel's registered domain (or one of its subdomains) or match an allowed origin. A TEST channel with no domain accepts any origin; once a domain is set it is matched as on LIVE.

X-SDK-Version?string

Version of the calling SDK (the Brainerce SDK sends it automatically). Informational: it is recorded on the channel and never changes the response.

curl -X GET "https://api.brainerce.com/api/vc/string/oauth/GOOGLE/callback?code=string&state=string&error=string&error_description=string" \  -H "origin: string" \  -H "X-SDK-Version: string"
{
  "error": "access_denied",
  "errorDescription": "string",
  "provider": "GOOGLE",
  "customer": {
    "id": "clcus_abc123",
    "email": "[email protected]",
    "firstName": "Jane",
    "lastName": "Doe",
    "phone": "string",
    "emailVerified": true
  },
  "token": "string",
  "expiresAt": "2026-01-15T10:30:00.000Z",
  "isNewCustomer": false,
  "linkedToExisting": true,
  "redirectUrl": "/account"
}

{
  "statusCode": 400,
  "code": "VALIDATION_FAILED",
  "message": "name should not be empty, price must be a positive number",
  "timestamp": "2026-08-23T10:15:00.000Z",
  "path": "/api/vc/{connectionId}/oauth/{provider}/callback"
}

{
  "statusCode": 403,
  "code": "INSUFFICIENT_SCOPE",
  "message": "API key does not have the required scope: products:write",
  "timestamp": "2026-08-23T10:15:00.000Z",
  "path": "/api/vc/{connectionId}/oauth/{provider}/callback"
}

{
  "statusCode": 404,
  "code": "RESOURCE_NOT_FOUND",
  "message": "Resource not found",
  "timestamp": "2026-08-23T10:15:00.000Z",
  "path": "/api/vc/{connectionId}/oauth/{provider}/callback"
}

{
  "statusCode": 429,
  "code": "RATE_LIMITED",
  "message": "Too many requests",
  "details": {
    "retryAfterSeconds": 12
  },
  "timestamp": "2026-08-23T10:15:00.000Z",
  "path": "/api/vc/{connectionId}/oauth/{provider}/callback"
}