# Wearable provider OAuth callback

Canonical page: https://docs.ovok.com/api/wearables/wearable-provider-oauth-callback

`GET /v1/wearables/oauth/{provider}/callback`

Where a wearable provider sends the patient's browser after consent. Register it as the redirect URL of your app at the provider; you never call it yourself.

**Auth:** none. The one-time `state` from `POST /v1/wearables/connections/<provider>/authorize` identifies the patient and project.

## Behaviour

- `state` is taken once. An expired, reused or unknown `state`, or one started for another provider, answers `422 INVALID_STATE`.
- With a valid `state`, the answer is always `302` to the project's patient app at `/wearables/<provider>?result=…`:
  - `connected`: the tokens are stored;
  - `denied`: the patient refused, or the provider sent an `error`;
  - `failed`: the code exchange or the save failed, the project switched the provider off meanwhile, or the provider refused to register the patient (Polar, when the patient has not accepted its consents). Nothing stays connected.
- `result` is for display only: the app should read `GET /v1/wearables/connections` for the state of record.
- When the pending authorization cannot be read, the answer is `503 STATE_STORE_UNAVAILABLE` with `Retry-After`; the `state` is kept, so the same callback can be retried.