Finish linking with the code GitHub returned
Spends the state cookie, exchanges the code for a user token, reads GET /user once for the account's numeric id and login, and drops the token: nothing of it is kept. Links that account to the caller (external_tenant github.com) and writes a link_account receipt. From then on the commits of sessions the caller starts name them as co-author, Co-authored-by: <login> <id+login@users.noreply.github.com>. A spent, expired or someone else's state, or a code GitHub refuses, is 400. Refused when the GitHub account is linked to someone else (never overwritten) or the caller already linked a GitHub account. API keys are refused.
Auth: cookie session only; no scope. Idempotency-Key: ignored.
cookieSession__Host-werft_session<token>For the web console: the browser session cookie set by POST /v1/auth/login. It holds the scopes of the user's workspace role (owner: all; admin and member: all but sessions:recover). Requests other than GET must also send X-Requested-With: werft-web.
X-Requested-With?"werft-web"Required with a cookie session: the literal werft-web.
"werft-web"application/json- body
code*string1 <= length <= 2048state*string1 <= length <= 512Linked; the account and the receipt.
application/json- response
linked_account*receipt_id*string^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$uuidcurl -X POST 'https://example.com/v1/linked-accounts/github/callback' \ -H 'Content-Type: application/json' \ -d '{ "code": "<code-from-github>", "state": "3q2-7wE"}'{ "linked_account": { "id": "0b3f1c2d-3e4f-4a5b-8c6d-7e8f9a0b1c2d", "user_id": "3e7f1a90-5c2d-4b8e-8f61-2a9d0c4b7e35", "provider": "github", "external_tenant": "github.com", "external_user_id": "583231", "external_tenant_name": "GitHub", "external_user_name": "octocat", "status": "active", "verified_at": "2026-10-30T09:01:00Z", "revision": 1, "expires_at": null }, "receipt_id": "c4a1e9d2-7b3f-4e8a-a6c5-1d2e3f4a5b6c"}