> ## Documentation Index > Fetch the complete documentation index at: https://docs.server.express/llms.txt > Use this file to discover all available pages before exploring further. # Finish an OAuth sign-in > Called by the portal's OAuth callback page. Verifies the signed `state`, swaps the provider's `code` for an access token, reads the user's identity and signs them in. Google creates an account on first sign-in (with the email already confirmed); Discord and Telegram only match an account that's already linked. If the account has a second factor, returns a pre-auth token instead of a session. Any failure after the state check — provider errors, an unlinked Discord/Telegram account, a banned or throwaway-email account — comes back as 500 carrying the reason. Not rate-limited. ## OpenAPI ````yaml /api-reference/openapi.yaml post /v1/auth/oauth/exchange openapi: 3.1.0 info: title: Server.Express API version: 1.0.0 description: >- The customer-facing Server.Express API: auth, billing, tickets, cloud and dedicated servers, hosting, reselling and account management. Every response uses the `{ success, data | error }` envelope. contact: name: Server.Express url: https://server.express servers: - url: https://my.server.express/api description: Production security: - bearerAuth: [] - apiToken: [] tags: - name: API Tokens - name: Account - name: Auth - name: Cloud - name: Coupons - name: Credits - name: Dashboard - name: Dedicated - name: Health - name: Hosting - name: Integrations - name: Invoices - name: Livechat - name: Notifications - name: Passkeys - name: Payments - name: Products - name: Public - name: Public Invoices - name: Public Tools - name: Reseller - name: SSH Keys - name: Services - name: Tasks - name: Teams - name: Tickets - name: Web Hosting - name: Webhooks paths: /v1/auth/oauth/exchange: post: tags: - Auth summary: Finish an OAuth sign-in description: >- Called by the portal's OAuth callback page. Verifies the signed `state`, swaps the provider's `code` for an access token, reads the user's identity and signs them in. Google creates an account on first sign-in (with the email already confirmed); Discord and Telegram only match an account that's already linked. If the account has a second factor, returns a pre-auth token instead of a session. Any failure after the state check — provider errors, an unlinked Discord/Telegram account, a banned or throwaway-email account — comes back as 500 carrying the reason. Not rate-limited. operationId: publicAuthOAuthExchange requestBody: required: true content: application/json: schema: type: object required: - provider - code - state properties: provider: type: string enum: - google - discord - telegram code: type: string description: The authorisation code from the provider's redirect. state: type: string description: >- The `state` from the redirect. Must have been minted for the same provider within 10 minutes. responses: '200': description: Signed in, or a second factor is required. content: application/json: schema: type: object required: - success - data properties: success: type: boolean const: true data: oneOf: - $ref: '#/components/schemas/PublicAuthOAuthSession' - $ref: '#/components/schemas/PublicAuthTwoFactorChallenge' '400': $ref: '#/components/responses/BadRequest' '500': $ref: '#/components/responses/ServerError' security: [] components: schemas: PublicAuthOAuthSession: type: object description: >- Session issued by an OAuth or Telegram Mini App sign-in. The user object also carries `bannedAt`. required: - accessToken - refreshToken - user properties: accessToken: type: string refreshToken: type: string user: allOf: - $ref: '#/components/schemas/PublicAuthSessionUser' - type: object properties: bannedAt: type: - string - 'null' format: date-time description: Always null here — a banned account never gets this far. PublicAuthTwoFactorChallenge: type: object description: >- The first factor worked but the account has a second. No session yet — finish with /v1/auth/2fa/code or the passkey pair /v1/auth/2fa/options + /v1/auth/2fa/verify. required: - twoFactorRequired - preAuthToken - methods properties: twoFactorRequired: type: boolean const: true preAuthToken: type: string description: >- Short-lived JWT that's only good for the /v1/auth/2fa/* sign-in routes. methods: type: object description: Which second factors to offer. required: - passkey - totp - backupCode properties: passkey: type: boolean totp: type: boolean backupCode: type: boolean description: True when at least one unused backup code remains. PublicAuthSessionUser: type: object required: - id - email - firstName - lastName - role properties: id: type: string format: uuid email: type: string format: email firstName: type: string lastName: type: string role: type: string enum: - CLIENT - ADMIN ErrorResponse: type: object required: - success - error properties: success: type: boolean const: false error: type: string description: Human-readable error message. additionalProperties: true responses: BadRequest: description: Validation failed or the request is malformed. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' ServerError: description: Unexpected server error. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- Session access token (JWT) from POST /v1/auth/login or /v1/auth/refresh. A session satisfies every API scope. apiToken: type: http scheme: bearer bearerFormat: se_live__ description: >- Personal API token created under Settings → API tokens. Only routes guarded by verifyApiAuth accept it, and the token must carry the scope named in the operation's x-required-scope. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.