Once the user has been redirected to the

/self-service/methods/oidc/callback/google

route with state and code parameters, the next step is to exchange the session token exchange code for a session token. This is part of the native app authentication flow described in the Ory documentation. Here are the general steps you would follow: 1. The native app initializes a login or registration flow and receives the first part of the session token exchange code from the Ory Network. 2. After the user performs the social sign-in, the user is redirected back to the native application via a specific URL. 3. The native application then exchanges the session token exchange code for a session token. In the context of a web application, you would typically handle this in your server-side logic or in a serverless function if you're using a platform like Vercel or Netlify. The exact implementation would depend on your application architecture and the libraries you're using. For more detailed instructions, you can refer to the [Ory documentation](https://www.ory.sh/docs/kratos/social-signin/native-apps#the-native-app-authentication-flow).

To exchange the session token exchange code for a session token, you can use the

GET /sessions/token-exchange

endpoint of the Ory API. This endpoint requires two parameters: - `init_code`: The first part of the code returned when initializing the flow. - `return_to_code`: The second part of the code returned by the

return_to

URL. Here's the API reference for this endpoint: [Ory API Reference](https://www.ory.sh/docs/reference/api) The session token exchange code is received in two parts: 1. The first part of the session token exchange code is received from the Ory Network when the native app initializes a login or registration flow. 2. The second part of the session token exchange code is received in the

code

URL query parameter when the Ory Network issues a session for the user and redirects the browser to the application's

return_to

URL. You can find more details about this process in the [Ory documentation](https://www.ory.sh/docs/kratos/social-signin/native-apps#steps-12-14-exchange-the-session-token-exchange-code-for-a-session-token).

Yes, you're correct. The

init_code

and

return_to_code

correspond to the

state

and

code

parameters respectively in the URL that the user is redirected to after they log in via Google sign-in. - `init_code`: This is the

state

parameter in the URL. It's the first part of the session token exchange code, returned when initializing the flow. - `return_to_code`: This is the

code

parameter in the URL. It's the second part of the session token exchange code, returned by the

return_to

URL. You can find more details about this process in the [Ory documentation](https://www.ory.sh/docs/kratos/social-signin/native-apps#steps-12-14-exchange-the-session-token-exchange-code-for-a-session-token).