Link Server Complete

Complete OAuth account linking without JWT.

Authenticates via the one-time state token stored in Redis during link_provider_init. Used when OAuth opens in an external browser (e.g., from Telegram Mini App). Provider is resolved from the state token if not explicitly provided.

POST /cabinet/auth/account/link/server-complete

Link Server Complete

cURL

curl --request POST \
  --url https://api.example.com/cabinet/auth/account/link/server-complete \
  --header 'Content-Type: application/json' \
  --data '
{
  "code": "<string>",
  "state": "<string>",
  "device_id": "<string>"
}
'

200

{
  "success": true,
  "provider": "<string>",
  "message": "<string>",
  "merge_required": false,
  "merge_token": "<string>"
}

Body

application/json

code · string · required

Authorization code from provider

Required string length: 1 - 2048

state · string · required

CSRF state token

Required string length: 1 - 128

provider · enum<string> | null

OAuth provider name (resolved from state if omitted)

Available options: google, yandex, discord, vk

device_id · string | null

Device ID from VK ID callback

Maximum string length: 256

Response

200

application/json

Successful Response

success · boolean · required

provider · string · required

message · string | null

merge_required · boolean · default: false

merge_token · string | null