OAuth Callback Handler

Next.js API route infrastructure that receives OAuth authorization code callbacks from BankID and Vipps after the user completes authentication in the in-app browser. Routes the callback to the appropriate integration service, handles CSRF state validation, and returns a platform JWT to the mobile client via the custom URL scheme redirect.

Feature: BankID & Vipps Authentication

oauth-callback-handler

• Expose secure callback endpoints for BankID and Vipps OAuth redirects
• Validate CSRF state parameter to prevent authorization code injection
• Route callback to the correct integration service based on provider
• Return platform JWT to the mobile client via redirect to custom URL scheme
• Log authentication events for audit and compliance