Step 2: Receive the code

After the user approves or denies your app in Step 1, their browser returns to your redirect_uri with the result in the query string. This request arrives at your server; there is no Shout About Us endpoint to call in this step. Check that state matches the value you stored, then pass the code to Step 3 straight away. The code works once and expires after 10 minutes.

Prerequisites: Step 1: Send the user to sign in, with the state you sent kept in the user's session.

Authentication: Public (no token). No token is involved. Check state to confirm the request belongs to a sign-in you started; if it doesn't match, stop and discard the code.

Rate limit: not applicable; this request is to your server.