diff --git a/worker/src/index.js b/worker/src/index.js
index 3bb4d47..ff18b68 100644
--- a/worker/src/index.js
+++ b/worker/src/index.js
@@ -1,4 +1,5 @@
 import { Router } from 'itty-router';
+import { githubCallback } from './routes/auth.js';
 
 const router = Router();
 
@@ -6,6 +7,8 @@ router.get('/', () => {
   return Response.json({ status: 'ok' });
 });
 
+router.get('/auth/github/callback', githubCallback);
+
 router.all('*', () => new Response('Not Found', { status: 404 }));
 
 export default {
diff --git a/worker/src/routes/auth.js b/worker/src/routes/auth.js
new file mode 100644
index 0000000..1911bf7
--- /dev/null
+++ b/worker/src/routes/auth.js
@@ -0,0 +1,27 @@
+export async function githubCallback(request, env) {
+  const url = new URL(request.url);
+  const code = url.searchParams.get('code');
+
+  if (!code) {
+    return Response.redirect(`${env.SPA_URL}/#/login?error=missing_code`, 302);
+  }
+
+  const tokenRes = await fetch('https://github.com/login/oauth/access_token', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+    body: JSON.stringify({
+      client_id: env.GITHUB_CLIENT_ID,
+      client_secret: env.GITHUB_CLIENT_SECRET,
+      code,
+    }),
+  });
+
+  const data = await tokenRes.json();
+
+  if (data.error || !data.access_token) {
+    const msg = data.error_description || data.error || 'token_exchange_failed';
+    return Response.redirect(`${env.SPA_URL}/#/login?error=${encodeURIComponent(msg)}`, 302);
+  }
+
+  return Response.redirect(`${env.SPA_URL}/#/auth/github?token=${data.access_token}`, 302);
+}