Every refused callback lands on `/login` with its reason; other errors (database) stay errors.

GET 
/api/v1/auth/oidc/callback

Every refused callback lands on /login with its reason; other errors (database) stay errors.

Request

Responses

302

Session established (bound as for localLogin); redirect to return_to, or to /choose when the session is bound to nothing yet. Without email_verified: true in the ID token when a verified address is required (service mode, auth.require_verified_email): no session, redirect to /verify-email.

Any other refused login opens no session and redirects to /login?error=<code>; the state is spent either way:

Code	Reason
oidc_expired	Unknown or expired state (10 min): the sign-in took too long or was started in another browser.
oidc_refused	The identity provider answered with error (e.g. access_denied).
oidc_failed	No code, the code exchange or the ID token's validation failed, or OIDC is not configured.
account_disabled	The user or their membership is disabled, or (self-hosted) the user is neither a member of an active installation tenant nor a platform admin.