> ## Documentation Index
> Fetch the complete documentation index at: https://tyk.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth / SAML callback

> The redirect URI registered with the external OAuth/OIDC provider or the SAML
Assertion Consumer Service (ACS) endpoint. TIB uses this to exchange the
authorization code (or process the SAML response) and complete the login action.

After a successful callback, TIB executes the profile's `ActionType` and
redirects the user to `ReturnURL`.




## OpenAPI

````yaml /swagger/5.13/identity-broker-swagger.yml get /auth/{id}/{provider}/callback
openapi: 3.0.3
info:
  title: Tyk Identity Broker (TIB) API
  description: >
    The Tyk Identity Broker (TIB) acts as a delegated authentication gateway
    between

    external identity providers (OAuth/Social, SAML, LDAP, Reverse Proxy) and
    the

    Tyk ecosystem.


    ## Authentication


    Profile management endpoints (`/api/*`) require an `Authorization` header
    whose

    value must exactly match the `Secret` field in `tib.conf`.


    Auth flow endpoints (`/auth/*`) are public — they are the entry points for

    end-user authentication and are called by browsers or API clients, not by

    back-end services.
  version: v1.7.2
  contact:
    email: support@tyk.io
    name: Tyk Technologies
    url: https://tyk.io/contact
servers:
  - url: http://localhost:3010
    description: Default local TIB instance
security: []
tags:
  - name: Auth
    description: Entry points for identity-provider authentication flows (public)
  - name: Profiles
    description: CRUD management of TIB profiles (requires Authorization header)
  - name: Health
    description: Health check
paths:
  /auth/{id}/{provider}/callback:
    get:
      tags:
        - Auth
      summary: OAuth / SAML callback
      description: >
        The redirect URI registered with the external OAuth/OIDC provider or the
        SAML

        Assertion Consumer Service (ACS) endpoint. TIB uses this to exchange the

        authorization code (or process the SAML response) and complete the login
        action.


        After a successful callback, TIB executes the profile's `ActionType` and

        redirects the user to `ReturnURL`.
      operationId: handleAuthCallback
      parameters:
        - $ref: '#/components/parameters/profileId'
        - $ref: '#/components/parameters/providerName'
        - name: code
          in: query
          description: OAuth 2.0 authorization code (OAuth flows only).
          schema:
            type: string
        - name: state
          in: query
          description: OAuth 2.0 state parameter for CSRF protection.
          schema:
            type: string
      responses:
        '302':
          description: Redirect to `ReturnURL` after successful authentication and action.
        '400':
          description: Missing profile ID or callback processing error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorMessage'
        '500':
          description: Internal error completing the identity action.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIErrorMessage'
components:
  parameters:
    profileId:
      name: id
      in: path
      required: true
      description: The unique identifier of the authentication profile.
      schema:
        type: string
      example: github-sso-dashboard
    providerName:
      name: provider
      in: path
      required: true
      description: >
        The provider sub-path. For Social/OIDC providers this is the Goth
        provider

        name (e.g. `github`, `linkedin`, `openid-connect`). For SAML it is
        `saml`.

        For LDAP/Proxy it matches the configured provider identifier.
      schema:
        type: string
      example: github
  schemas:
    APIErrorMessage:
      type: object
      properties:
        Status:
          type: string
          enum:
            - error
          example: error
        Error:
          type: string
          description: Human-readable error message.
          example: Profile not found

````