Skip to main content

OAuth Callback

POST 
/api/magento2/oauth/callback

Public, unauthenticated endpoint — Magento Admin POSTs the OAuth 1.0a activation payload here when the merchant clicks Activate on a Magento Integration.

Flow on success:

  1. We immediately return 200 { success: true, oauth_verifier: ... } so Magento marks the integration Active.
  2. We then asynchronously POST to {store_base_url}/oauth/token/request to get a temporary request token, and {store_base_url}/oauth/token/access (with the verifier) to upgrade it into the permanent access token + secret. This deferred-exchange pattern (via fastcgi_finish_request() or register_shutdown_function) avoids deadlocking Magento's PHP-FPM worker pool — Magento's own Laminas HTTP client expects to read our response before it can serve our outbound OAuth calls.
  3. Structured outcomes (success/failure + last-4-of-token) are logged to laravel.log so install operations can be debugged.

Body parameters (form-urlencoded, as Magento Admin POSTs):

  • oauth_consumer_key (required, string) — Magento Integration consumer key.
  • oauth_consumer_secret (required, string) — Magento Integration consumer secret.
  • oauth_verifier (required, string) — one-time verifier for the token exchange.
  • store_base_url (required, string) — Magento storefront URL.

Behavior:

  • If any field is missing, the endpoint still returns HTTP 200 (so Magento Admin doesn't surface a misleading 'post to consumer failed' error) but with success: false and a message; the OAuth exchange is skipped.
  • The endpoint never throws — exchange failures are logged but not propagated to the response (Magento has already left the conversation by then).

Authentication: None — this is a public webhook. CSRF is bypassed by the wildcard */callback rule in bootstrap/app.php.

Request​

Responses​

OK

Response Headers
    Content-Type