Step 2 — Receive code on your callback (browser leg, no Postman action)

⚠️ Browser leg — not a Postman-callable request

This step happens entirely in the user's browser. Review Management redirects the browser back to the redirect_uri you registered with us, appending two query params:

• code — a short-lived authorization code (single-use, expires in ~10 minutes).
• state — the exact random string your server sent in Step 1.

What your server must do when the callback hits

1. Verify state matches the value you stored in the user's session before the Step-1 redirect. If it doesn't match, abort the flow — it's a CSRF attempt.
2. Capture code and immediately call Step 3 (Exchange code for token) from your backend. Do NOT send the code from the browser.
3. code is single-use and short-lived — exchange it within seconds of receipt.

Why no Postman request here

There is no API call for this step. The browser receives the 302 response from Review Management's /oauth/authorize and follows it to your redirect_uri. Your application is the receiver — Review Management has no further role until you call Step 3.

This entry exists for documentation continuity between Step 1 and Step 3 — it cannot be executed.