> ## Documentation Index
> Fetch the complete documentation index at: https://developer.finogates.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Finalise a Card-Connect Redirect

> Posted by the Finogate-FE landing page after the end-user returns from the hosted card form. Verifies the signed ``state``, exchanges the ``code`` server-side, persists the new card, and returns the pre-registered ``return_url`` so the FE can bounce the end-user back to the platform. Unauthenticated by design — the FE landing page is a public bounce target with no inherent client credentials, and the signed ``state`` JWT carries the tenant + user attribution (HMAC-verified, TTL-bounded, single-use via Redis nonce in ``handle_callback``).



## OpenAPI

````yaml POST /v1/platform/payment-methods/cards/connect/callback
openapi: 3.1.0
info:
  title: Finogate Platform API v1
  version: 0.1.0
servers:
  - url: https://api-sandbox.finogates.com
    description: Sandbox
  - url: https://api.finogates.com
    description: Production
security: []
tags:
  - name: auth
  - name: users
  - name: payees
  - name: verification
  - name: bank accounts
  - name: card processing
  - name: digital-assets
  - name: international
  - name: fees
  - name: onboarding
  - name: pending-applications
  - name: wallets
  - name: payments
  - name: document mailing
  - name: merchant onboarding
  - name: catalog
  - name: webhooks
  - name: screening
  - name: Platform - File Scanning
  - name: phone-numbers
  - name: sms
  - name: calls
  - name: listings
  - name: Card Transfers
  - name: embed-tokens
paths:
  /v1/platform/payment-methods/cards/connect/callback:
    post:
      tags:
        - Card Transfers
      summary: Finalise a card-connect redirect
      description: >-
        Posted by the Finogate-FE landing page after the end-user returns from
        the hosted card form. Verifies the signed ``state``, exchanges the
        ``code`` server-side, persists the new card, and returns the
        pre-registered ``return_url`` so the FE can bounce the end-user back to
        the platform. Unauthenticated by design — the FE landing page is a
        public bounce target with no inherent client credentials, and the signed
        ``state`` JWT carries the tenant + user attribution (HMAC-verified,
        TTL-bounded, single-use via Redis nonce in ``handle_callback``).
      operationId: >-
        connect_card_callback_v1_platform_payment_methods_cards_connect_callback_post
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuthCallbackCreate'
        required: true
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/CommonResponse'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - _AuthenticatedBearer: []
components:
  schemas:
    OAuthCallbackCreate:
      properties:
        code:
          anyOf:
            - type: string
              maxLength: 512
            - type: 'null'
          title: Code
        state:
          type: string
          maxLength: 2048
          minLength: 1
          title: State
      type: object
      required:
        - state
      title: OAuthCallbackCreate
      description: |-
        Posted by the Finogate FE landing page after the end-user returns.

        ``code`` and ``state`` are read verbatim from the callback URL the user
        landed on. The BE verifies the signed ``state``, then:

        * If ``code`` is present (verified flow via ``/login/oauth/authorize``)
          → exchange the code at ``POST /oauth/token`` for an access_token +
          card_id, fetch + persist that card.
        * If ``code`` is absent (receive-only flow which does NOT emit an auth
          code) → look up the user's existing link from the signed state, mint an
          access_token via the partner-identity flow, list the user's cards,
          persist any new ones.

        ``state`` is therefore the load-bearing identifier — it carries the
        tenant + user + mode + return_url attribution and is HMAC-verified by
        :func:`oauth_state.decode_state`. ``code``, when present, is supplied by
        the processor and is single-use at their end.
    CommonResponse:
      properties:
        status_code:
          type: integer
          title: Status Code
          description: HTTP status code for the response.
        data:
          title: Data
          description: Payload or error details.
        query_generated_time:
          type: integer
          title: Query Generated Time
          description: >-
            UTC timestamp (milliseconds since epoch) when response was
            generated.
      type: object
      required:
        - status_code
        - data
        - query_generated_time
      title: CommonResponse
      description: |-
        Standard response wrapper for single-object responses and errors.

        Generic over the payload type. A route that declares
        ``CommonResponse[SomeModel]`` gets the real ``data`` schema rendered in
        OpenAPI/Swagger; a bare ``CommonResponse`` leaves ``data`` untyped.
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
  securitySchemes:
    _AuthenticatedBearer:
      type: oauth2
      flows:
        password:
          scopes: {}
          tokenUrl: /v1/platform/auth/token

````