Are you an LLM? Read llms.txt for a summary of the docs, or llms-full.txt for the full context.
Skip to content

Relying Party

When Aero2 acts as a Relying Party (RP), it lets users sign in with external identity providers like GitHub or Google. These endpoints handle the OAuth2 flow with external IdPs.

See RP vs Provider for when Aero2 uses each role.

GET/rp/authorizeNo Auth

Initiates the OAuth flow with an external identity provider. Redirects the user to the provider's authorization endpoint.

ParameterTypeDescription
idp*
query		stringIdentity provider name (e.g., "github"). Must match a configured IdP.
redirect_uri
query		stringWhere to redirect after login completes
Response
HTTP 302 → Redirect to external IdP authorization endpoint
Try in Playground →
GET/rp/callback/:idpNo Auth

Handles the OAuth callback from an external IdP. Validates state (cookie + DB), exchanges code for token, fetches user info, creates/links local user, and establishes a session.

ParameterTypeDescription
idp*
path		stringThe identity provider name (e.g., "github")
code*
query		stringAuthorization code from the external IdP
state*
query		stringState parameter for CSRF validation
Response
HTTP 302 → Redirect to dashboard (with session cookie set) or login on error
Try in Playground →
GET/rp/userinfoSession

Returns profile information for the currently authenticated user (via session cookie).

Response
{
  "id": "user-uuid",
  "email": "jane@example.com",
  "name": "Jane Doe",
  "picture": "https://avatars.githubusercontent.com/u/12345",
  "roles": [
    "user"
  ]
}
Try in Playground →

Flow

  1. User visits /rp/authorize?idp=github
  2. Aero2 redirects to GitHub's authorization page
  3. GitHub redirects back to /rp/callback/github with a code
  4. Aero2 exchanges the code, fetches user info, and creates a local session
  5. User is redirected to the dashboard (or specified redirect_uri)