How can I programmatically authenticate a contact (via checksum or other method)?
CRM_Contact_BAO_Contact_Utils::generateChecksum($contactId) is the function used to generate checksums.

Ideally your extension would call this via a corresponding API method, but I don't think one exists yet?

There's corresponding code (see validChecksum etc below that) which is used in some CiviCRM pages to identify a request with a checksum parameter.

Simple code to identify a checksum and persist against the contact is the following -

if ($cs = CRM_Utils_Request::retrieve('cs', 'String' , $this, false)) {
  if ($id = CRM_Utils_Request::retrieve('cid', 'Positive', $this, false, $userID)) {
    if (CRM_Contact_BAO_Contact_Utils::validChecksum($id, $cs)) {
      $session-&gt;set('userID', $id) ;
    }
  }
}


If they are landing on your callback already, then you can just dispense with using the checksum parameter and set the session directly before redirecting them to the page they authenticated to use.