diff --git a/src/index.js b/src/index.js
index a36a6c7..4de1ee8 100644
--- a/src/index.js
+++ b/src/index.js
@@ -5,7 +5,7 @@ import { handleStatus } from './routes/status.js'
 
 const router = Router()
 
-router.get('/auth/github/callback', githubCallback)
+router.get('/callback/github', githubCallback)
 router.post('/extract', handleExtract)
 router.get('/status', handleStatus)
 router.options('*', () => new Response(null, { status: 204 }))
@@ -18,6 +18,7 @@ function withCors(response, request, env) {
   headers.set('Access-Control-Allow-Origin', env.SPA_URL)
   headers.set('Access-Control-Allow-Methods', 'GET, POST, OPTIONS')
   headers.set('Access-Control-Allow-Headers', 'Content-Type')
+  headers.set('Vary', 'Origin')
   return new Response(response.body, { status: response.status, statusText: response.statusText, headers })
 }
 
diff --git a/src/routes/auth.js b/src/routes/auth.js
index 1911bf7..e0a648d 100644
--- a/src/routes/auth.js
+++ b/src/routes/auth.js
@@ -1,9 +1,10 @@
 export async function githubCallback(request, env) {
-  const url = new URL(request.url);
-  const code = url.searchParams.get('code');
+  const url = new URL(request.url)
+  const code = url.searchParams.get('code')
+  const state = url.searchParams.get('state')
 
   if (!code) {
-    return Response.redirect(`${env.SPA_URL}/#/login?error=missing_code`, 302);
+    return Response.redirect(`${env.SPA_URL}/#/login?error=no_code`, 302)
   }
 
   const tokenRes = await fetch('https://github.com/login/oauth/access_token', {
@@ -14,14 +15,19 @@ export async function githubCallback(request, env) {
       client_secret: env.GITHUB_CLIENT_SECRET,
       code,
     }),
-  });
+  })
 
-  const data = await tokenRes.json();
+  const data = await tokenRes.json()
 
   if (data.error || !data.access_token) {
-    const msg = data.error_description || data.error || 'token_exchange_failed';
-    return Response.redirect(`${env.SPA_URL}/#/login?error=${encodeURIComponent(msg)}`, 302);
+    const msg = data.error_description || data.error || 'token_exchange_failed'
+    return Response.redirect(
+      `${env.SPA_URL}/#/login?error=${encodeURIComponent(msg)}`,
+      302,
+    )
   }
 
-  return Response.redirect(`${env.SPA_URL}/#/auth/github?token=${data.access_token}`, 302);
+  const params = new URLSearchParams({ token: data.access_token })
+  if (state) params.set('state', state)
+  return Response.redirect(`${env.SPA_URL}/#/auth/github?${params}`, 302)
 }
diff --git a/wrangler.toml b/wrangler.toml
index edac947..0f01ae0 100644
--- a/wrangler.toml
+++ b/wrangler.toml
@@ -1,4 +1,4 @@
-name = "git-extract-worker"
+name = "git-extract"
 main = "src/index.js"
 compatibility_date = "2024-01-01"