Where a sign-in ends

GET

/auth/zoho/done

const url = 'https://api.sloose.com/auth/zoho/done';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url https://api.sloose.com/auth/zoho/done

Better Auth sends the browser here after its callback, with the session cookie it just set — or with ?error= when the sign-in failed. A popup’s sign-in (the default) is answered with the popup page that hands { type: "sloose:session", token, orgId, userId, role, exp } to the opener — orgId and role are null for a person in no organisation yet; on failure the page carries { type: "sloose:auth-error", message }. A page’s sign-in (mode=redirect) is answered 303 to ret + /sign-in/zoho, the fragment carrying a one-use hand-off code (code, a minute’s secret, traded at POST /auth/zoho/handoff) or the refusal’s code (error), and the nonce n either way.

Either way the session cookie Better Auth set on this host is expired: the API’s own host keeps none once the session is handed on.

You never call this directly.

Parameters

Query Parameters

ret

The origin the session is posted to; checked again here.

string

The origin the session is posted to; checked again here.

mode

redirect for a page’s sign-in; absent for a popup’s.

string

redirect for a page’s sign-in; absent for a popup’s.

With mode=redirect: the tab’s nonce, handed back beside the code.

string

With mode=redirect: the tab’s nonce, handed back beside the code.

error

Set by Better Auth when the sign-in failed.

string

Set by Better Auth when the sign-in failed.

error_description

The reason, when there is one.

string

The reason, when there is one.

Responses

200

A small HTML page that posts the outcome to window.opener and closes itself. Not a JSON API.

text/html

string

303

A page’s sign-in, back to ret + /sign-in/zoho with the hand-off.

400

A small HTML page that posts the outcome to window.opener and closes itself. Not a JSON API.

text/html

string

403

A small HTML page that posts the outcome to window.opener and closes itself. Not a JSON API.

text/html

string

503

The restore switch is on (code: MAINTENANCE): every route but /health and /robots.txt is refused before anything is read, except the operator’s own POST /staff/people/{id}/delete with the ADMIN_TOKEN. Sloose is down for maintenance. Please try again in a few minutes.

application/json

object

error

required

string

code

required

string

Allowed value: MAINTENANCE

Example

{
  "code": "MAINTENANCE"
}

Headers

Retry-After

integer

Seconds until asking again is worth it (300 while the switch is on).

Report a problem with this page

sloose.com