OAuth callback (provider redirect)

Landing endpoint for the provider redirect — not called directly by integrators. Exchanges Airbyte's secret_id for a source and creates the connection.

Unauthenticated by design: the redirect arrives from a browser and carries no API key, so the single-use state token in the path is the credential. Airbyte replaces the query string on this redirect, which is why state is a path segment.

On success, redirects (302) to the return_url given at initiation with mythic_oauth=success and mythic_connection_id=… appended; on failure, with mythic_oauth=error and mythic_error_code=…. Parameters are namespaced so they cannot collide with your own query string, which is preserved.

mythic_error_code is drawn from a closed set you can switch on: state_invalid (expired, already used, or unreadable), missing_secret_id, missing_account_id, not_configured, not_provisioned, source_config_rejected (Airbyte refused the source payload against the connector's schema — a Mythic-side bug that consenting again cannot fix, so do NOT prompt the user to retry; report it), oauth_secret_expired (the provider credential Airbyte minted was gone by the time the source was created — start the connection again), account_not_accessible (consent succeeded but the account named at initiation is not one that user can reach — fix the account id, not the consent), connection_failed (anything else). Exception messages are never placed in the URL — they stay in server logs.

Because connection_failed is a catch-all, a failed callback also writes a row to the sync-event log with error_origin: oauth_callback and the underlying message in error_message. Read it at GET /sync-events?client_id=… — it is the only trail a failed consent leaves, since no connection is created.

When no return_url was given, this renders a minimal terminal HTML page rather than JSON, because the client here is always a browser. Rate limited to 20 requests per 10 minutes per IP.

curl -X GET "https://mythic-analytics.gulp.workers.dev/client/v1/airbyte/oauth/callback/example_string?secret_id=example_string" \
  -H "Content-Type: application/json"

import requests
import json

url = "https://mythic-analytics.gulp.workers.dev/client/v1/airbyte/oauth/callback/example_string?secret_id=example_string"
headers = {
  "Content-Type": "application/json"
}

response = requests.get(url, headers=headers)
print(response.json())

const response = await fetch("https://mythic-analytics.gulp.workers.dev/client/v1/airbyte/oauth/callback/example_string?secret_id=example_string", {
  method: "GET",
  headers: {
  "Content-Type": "application/json"
}
});

const data = await response.json();
console.log(data);

package main

import (
    "fmt"
    "net/http"
)

func main() {

    req, err := http.NewRequest("GET", "https://mythic-analytics.gulp.workers.dev/client/v1/airbyte/oauth/callback/example_string?secret_id=example_string", nil)
    if err != nil {
        panic(err)
    }

    req.Header.Set("Content-Type", "application/json")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    fmt.Println("Response Status:", resp.Status)
}

require 'net/http'
require 'json'

uri = URI('https://mythic-analytics.gulp.workers.dev/client/v1/airbyte/oauth/callback/example_string?secret_id=example_string')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true

request = Net::HTTP::Get.new(uri)
request['Content-Type'] = 'application/json'

response = http.request(request)
puts response.body

{}

{
  "error": "Bad Request",
  "message": "The request contains invalid parameters or malformed data",
  "code": 400,
  "details": [
    {
      "field": "email",
      "message": "Invalid email format"
    }
  ]
}