---
title: "Where AuthKit sends the browser back (sets the session cookie)"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.gitpando.com/llms.txt
> Use this file to discover all available pages before exploring further.

Path: Pando API › users

`GET /v1/login/callback`

## Code samples

### cURL

```curl
curl --request GET \
  --url https://app.gitpando.com/v1/login/callback
```

### TypeScript

```typescript
const url = 'https://app.gitpando.com/v1/login/callback';
const options = {method: 'GET'};

fetch(url, options)
  .then(res => res.json())
  .then(json => console.log(json))
  .catch(err => console.error(err));
```

### Python

```python
import requests

url = "https://app.gitpando.com/v1/login/callback"

response = requests.get(url)

print(response.text)
```

## Responses

### 302

To `return_to`, with `__Host-pando_session` set.

### 400

`bad_state` (no matching sign-in, or older than 10 minutes) or `sign_in_failed`.

#### Example

```json
{
  "error": {
    "code": "string",
    "message": "string",
    "paths": [
      "string"
    ],
    "checks": {
      "sha": "string",
      "state": "success",
      "required": [
        "string"
      ],
      "checks_unknown": "string",
      "missing": [
        "string"
      ],
      "statuses": [
        {
          "sha": "string",
          "context": "string",
          "state": "pending",
          "target_url": "string",
          "description": "string",
          "creator": "string",
          "app": "string",
          "created_at": "2019-08-24T14:15:22Z"
        }
      ]
    }
  }
}
```

- `loginCallback.response.400.error` (object, required)
  - `loginCallback.response.400.error.code` (string, required)
  - `loginCallback.response.400.error.message` (string, required)
  - `loginCallback.response.400.error.paths` (array<string>, optional)
  - `loginCallback.response.400.error.checks` (object, optional) — GitHub's combined status, plus the required contexts and which are missing.
    - `loginCallback.response.400.error.checks.sha` (string | null, required)
    - `loginCallback.response.400.error.checks.state` (string, required) — `success` when the merge gate passes; `missing` when a required context has not reported; `unknown` while the required checks are (an unforced merge is refused).
      - one of `"success"`, `"pending"`, `"failure"`, `"error"`, `"missing"`, `"unknown"`
    - `loginCallback.response.400.error.checks.required` (array | null, required) — Null while unknown.
    - `loginCallback.response.400.error.checks.checks_unknown` (string | null, required) — Why the required checks are unknown, in plain words: "Pando couldn't read this monorepo's required checks; try again", or "pando.toml line 3: expected comma or end of structure; fix it on main, or merge with force". Null otherwise.
    - `loginCallback.response.400.error.checks.statuses` (array<object>, required) — The latest status per context.
      - `loginCallback.response.400.error.checks.statuses.sha` (string, required)
      - `loginCallback.response.400.error.checks.statuses.context` (string, required)
      - `loginCallback.response.400.error.checks.statuses.state` (string, required)
        - one of `"pending"`, `"success"`, `"failure"`, `"error"`
      - `loginCallback.response.400.error.checks.statuses.created_at` (string, required)
        - format `date-time`
      - `loginCallback.response.400.error.checks.statuses.target_url` (string | null, optional)
      - `loginCallback.response.400.error.checks.statuses.description` (string | null, optional)
      - `loginCallback.response.400.error.checks.statuses.creator` (string, optional) — The member who posted it (a login); `app:<slug>` for a status posted with a status token or by a CI integration; `hook:<hook id>` for a status token from a web hook with no app.
      - `loginCallback.response.400.error.checks.statuses.app` (string | null, optional) — The CI service that reported it (`buildkite`, `github-actions`, ...), stamped by Pando from a status token or a CI integration, never from the body or `target_url`. Null when a member posted it with their own credential. The web shows the service's mark for a slug it knows.
    - `loginCallback.response.400.error.checks.missing` (array<string>, optional)


Source: https://docs.gitpando.com/api/users/loginCallback/index.md