GET /v1/oauth/callback/itchio

itch.io implicit-flow landing page. Serves a page that reads the fragment token in the browser and posts it to /v1/oauth/itchio.

POST /v1/oauth/itchio

itch.io token post-back: resolve the instance from state, exchange the implicit token for the profile, and complete the sign-in (MFA gate). Returns the continuation URL.

GET /v1/oauth/callback/lastfm/:state

Last.fm callback (state in the path). Exchanges the approval token for a session via an MD5-signed auth.getSession and redirects back with a one-time ticket.

GET /v1/oauth/bluesky/client-metadata.json

AT Protocol OAuth client metadata document. Its URL is the Bluesky client_id; the authorization server fetches it during PAR to learn redirect URIs and scopes.

GET /v1/oauth/callback/:provider

Provider redirect target. Redirects back with a one-time ticket, never a token.

POST /v1/oauth/callback/:provider

Provider form_post callback (Apple).