The provider's redirect back after sign-in.
Browser-facing: every outcome is a redirect into the Studio. Accepted only from the browser that started the sign-in: the `state` must match the `sluby_signin` cookie set by the login route, within ten minutes. The account is the provider's stable id (GitHub: the numeric account id), never the login. A failure redirects to the page the sign-in started from (or `/studio` once the handshake is lost) with `signin_error=<code>` added: `expired_handshake` (expired, or started in another browser), `not_a_member` (with `&handle=<login>`, nobody added this account; people join through invites), `disabled` (with `&handle`, an admin removed the member), `already_linked` (with `&handle`, joining or linking with an account another member already signs in with), `not_signed_in` (a link finished without the session it began in), `invite_not_found`, `invite_used`, `invite_expired`, `invite_revoked` (with `&handle`, joining with an invite that does not work), `cancelled` (the person declined at the provider), `provider_failed` (the provider refused the code or could not be reached) or `not_configured`. A join signs the new member in; a link keeps the current session.
Browser-facing: every outcome is a redirect into the Studio. Accepted only from the browser that started the sign-in: the state must match the sluby_signin cookie set by the login route, within ten minutes. The account is the provider's stable id (GitHub: the numeric account id), never the login. A failure redirects to the page the sign-in started from (or /studio once the handshake is lost) with signin_error=<code> added: expired_handshake (expired, or started in another browser), not_a_member (with &handle=<login>, nobody added this account; people join through invites), disabled (with &handle, an admin removed the member), already_linked (with &handle, joining or linking with an account another member already signs in with), not_signed_in (a link finished without the session it began in), invite_not_found, invite_used, invite_expired, invite_revoked (with &handle, joining with an invite that does not work), cancelled (the person declined at the provider), provider_failed (the provider refused the code or could not be reached) or not_configured. A join signs the new member in; a link keeps the current session.
provider*"github"The sign-in provider.
"github"Signed in (redirect to next with a session cookie), or failed (redirect to next, or /studio, with signin_error=<code>).
curl -X GET 'https://sluby.example.com/api/v1/auth/github/callback'Begin a Studio sign-in with a provider. GET
Sets the short-lived `sluby_signin` cookie (path /api/v1/auth) holding the handshake state and where to land afterwards, then redirects to the provider. `next` is a path on this server; anything that would leave the origin falls back to /studio.
How this server signs people in. GET
Public: the Studio reads it before anyone is signed in, to show the setup screen or the sign-in methods.