Skip to main content

Start the authorization code flow

GET 
/authorize

The authorization endpoint. PKCE is mandatory — code_challenge is required and code_challenge_method must be S256; OAuth 2.1 forbids plain.

A user who has not yet consented is redirected to the consent screen at /app/oauth/consent; once consent is recorded, a second call to this endpoint redirects to redirect_uri with a single-use code. Parameter errors that can be attributed to a registered redirect_uri are reported as a redirect carrying error, per RFC 6749; an unknown client_id or an unregistered redirect_uri answers 400 directly, because there is no trustworthy place to send the user.

Request​

Responses​

Redirect to redirect_uri with code and state, to the consent screen when consent is still needed, or back to redirect_uri with error for a parameter the client can fix.

Response Headers
    Location

    Where the user agent is sent next.