# List callback

URL: https://docs.hanzo.ai/docs/openapi/team/get-team-account-auth-by-provider-callback

> COMPLETES the OAuth hop: hanzo.id redirects the browser here with ?code and ?state, and the answer is another 302 — back to the client's login route carrying the freshly minted team session token in the query.

`GET /v1/team/account/auth/{provider}/callback`

> [Team →](https://docs.hanzo.ai/docs/openapi/team) · [All API references →](https://docs.hanzo.ai/docs/openapi) · [Get started →](https://docs.hanzo.ai/docs/guides)

|               |                                                                 |
| ------------- | --------------------------------------------------------------- |
| **Address**   | `https://api.hanzo.ai/v1/team/account/auth/{provider}/callback` |
| **Method**    | `GET`                                                           |
| **Operation** | `get_team_account_auth_by_provider_callback`                    |
| **Auth**      | `Authorization: Bearer $HANZO_API_KEY`                          |

COMPLETES the OAuth hop: hanzo.id redirects the browser here with ?code and ?state, and the answer is another 302 — back to the client's login route carrying the freshly minted team session token in the query. Never JSON, and never a token in this response's own body.

THE STATE IS CHECKED FIRST, before the code is even looked at: the flow cookie is read and cleared one-shot, and a callback whose ?state does not equal the nonce it held is bounced with error=state\_mismatch and NEVER exchanged. That is what makes a forged or replayed callback inert. Only then is the code exchanged server-side — team is a confidential client with a client\_secret, so there is no PKCE and the code never passes through the browser's JS.

The tenant is derived from the IAM access token VERIFIED RS256 against the JWKS, the same trust anchor the identity boundary uses; a token whose owner claim is empty fails closed with no login at all. Every org that token proves gets a space ensured, so a member of two orgs is a counted seat in both. The IAM access token is also parked in an HttpOnly cookie for the same-origin agents proxy — page JS never reads it.

EVERY failure is a redirect, not a status: a denied consent, a missing code, a failed exchange, an unreadable userinfo, an unverifiable org and a token-mint failure each bounce to the login page with an ?error code naming the step.

## Request

1 field.

| Field      | In   | Type   | Required | Description |
| ---------- | ---- | ------ | -------- | ----------- |
| `provider` | path | string | yes      |             |

## Response

The document declares no response body for this operation. It answers `200` on success and the platform error shape on failure — see [Errors](https://docs.hanzo.ai/docs/errors).

## Examples

**CLI**

```bash
hanzo team account auth callback <provider>
```

**SDK**

**.ts**

```ts
import { Configuration, TeamApi } from 'hanzoai';

const api = new TeamApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getTeamAccountAuthByProviderCallback({ provider: 'provider' });
```

**.py**

```python
from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import TeamApi

client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = TeamApi(client).get_team_account_auth_by_provider_callback(provider='provider')
```

**.go**

```go
cfg := hanzoai.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := hanzoai.NewAPIClient(cfg)

resp, _, err := client.TeamAPI.GetTeamAccountAuthByProviderCallback(context.Background()).Execute()
if err != nil {
	return err
}
```

**.rs**

```rust
use hanzo_client::apis::{configuration::Configuration, team_api};

let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();

let result = team_api::get_team_account_auth_by_provider_callback(&cfg, Default::default()).await?;
```

**.java**

```java
import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.TeamApi;

ApiClient client = new ApiClient();
client.setBearerToken(System.getenv("HANZO_API_KEY"));

var result = new TeamApi(client).getTeamAccountAuthByProviderCallback();
```

**HTTP**

```bash
curl https://api.hanzo.ai/v1/team/account/auth/<provider>/callback \
  -H "Authorization: Bearer $HANZO_API_KEY"
```

**MCP**

MCP reaches **team** through the `team` tool, which names its 33 operations with its own verbs — this one among them, under a name only MCP declares. `describe` explains any of them:

```bash
curl -X POST https://api.hanzo.ai/v1/mcp \
  -H "Content-Type: application/json" \
  -d '{
       "jsonrpc": "2.0",
       "id": 1,
       "method": "tools/call",
       "params": {
         "name": "describe",
         "arguments": {
           "op": "list_team_account_providers"
         }
       }
     }'
```

---

[Team API](https://docs.hanzo.ai/docs/openapi/team) · [All Hanzo APIs](https://docs.hanzo.ai/docs/openapi) · [Interactive reference](https://docs.hanzo.ai/docs/openapi/reference)