OAuth redirect target that receives the authorization code

curl --request GET \
  --url https://api-dev.narrative.io/mcp-connections/callback

const options = {method: 'GET'};

fetch('https://api-dev.narrative.io/mcp-connections/callback', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-dev.narrative.io/mcp-connections/callback",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api-dev.narrative.io/mcp-connections/callback"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api-dev.narrative.io/mcp-connections/callback")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body

MCP Connections

OAuth redirect target that receives the authorization code

The OAuth redirect URI. The external authorization server sends the user’s browser here after they consent, so the request carries no Narrative bearer token.

This endpoint does not complete the connection. It stores the code against its flow server-side and then redirects the browser (303) to the Narrative app, which finishes the job by calling POST /mcp-connections/complete with the signed-in user’s own credentials.

You never call this directly — it’s the redirect_uri the browser is sent to.

Why it can’t complete the connection

Because it is public, anyone could reach it. If the callback also exchanged the code, someone could start a flow of their own, get another user to open the resulting consent URL, and end up with that user’s access token stored on their own connection. Splitting the flow removes that: the state only lets you deposit a code, and exchanging one requires an authenticated request from the user the flow belongs to.

The stored code is useless on its own — the exchange also needs the flow’s PKCE code_verifier, which never leaves the server — and it is never included in the redirect URL.

Redirect parameters

The Location always points at the app’s callback page, with:

Parameter	When
`state`	Whenever the incoming `state` was well-formed. The app posts it back to complete the connection.
`error`	Only on failure, see below. Absent means the code was stored and the app should complete.

`error` values

Value	Meaning
`access_denied`	The user declined at the authorization server (RFC 6749 §4.1.2.1).
`invalid_request`, `unauthorized_client`, `unsupported_response_type`, `invalid_scope`, `server_error`, `temporarily_unavailable`	Other authorization-server failures, per RFC 6749 §4.1.2.1. An unrecognized code is reported as `server_error` rather than echoed.
`invalid_state`	The `state` was malformed.
`unknown_state`	No authorization flow matches the `state` — it expired, or was already used.
`invalid_callback`	Neither `code` nor `error` was present, or `state` was missing.

Authentication

Public (no bearer). A state alone cannot produce a token — see above.

GET

mcp-connections

callback

OAuth redirect target that receives the authorization code

curl --request GET \
  --url https://api-dev.narrative.io/mcp-connections/callback

const options = {method: 'GET'};

fetch('https://api-dev.narrative.io/mcp-connections/callback', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api-dev.narrative.io/mcp-connections/callback",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api-dev.narrative.io/mcp-connections/callback"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api-dev.narrative.io/mcp-connections/callback")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body

Query Parameters

state

string

The one-time state issued by POST /mcp-connections; identifies the authorization flow this callback belongs to. Optional only so that a malformed callback still redirects the browser to a page that can explain itself; in practice the authorization server always returns it.

code

string

The one-time authorization code issued by the external authorization server. Present on success, mutually exclusive with error.

error

string

An RFC 6749 §4.1.2.1 error code, sent instead of code when the user declines or the authorization server refuses.

Response

303

The browser is redirected to the Narrative app's callback page, which completes the connection. Every outcome is reported this way — success, the user declining, an expired state — with the details in the query parameters rather than in an error body.

⌘I