# Start the authorization code flow

> The authorization endpoint. PKCE is mandatory — `code_challenge` is required and

<Heading
  as={"h1"}
  className={"openapi__heading"}
  children={"Start the authorization code flow"}
>
</Heading>

<MethodEndpoint
  method={"get"}
  path={"/authorize"}
  context={"endpoint"}
>
  
</MethodEndpoint>

The authorization endpoint. PKCE is mandatory — `code_challenge` is required and
`code_challenge_method` must be `S256`; OAuth 2.1 forbids `plain`.

A user who has not yet consented is redirected to the consent screen at
`/app/oauth/consent`; once consent is recorded, a second call to this endpoint redirects to
`redirect_uri` with a single-use `code`. Parameter errors that can be attributed to a
registered `redirect_uri` are reported as a redirect carrying `error`, per RFC 6749;
an unknown `client_id` or an unregistered `redirect_uri` answers `400` directly, because
there is no trustworthy place to send the user.

<Heading
  id={"request"}
  as={"h2"}
  className={"openapi-tabs__heading"}
>
  <Translate id="theme.openapi.request.title">Request</Translate>
</Heading>

<ParamsDetails
  {...require("./authorize-oauth-client.ParamsDetails.json")}
>
  
</ParamsDetails>

<RequestSchema
  {...require("./authorize-oauth-client.RequestSchema.json")}
>
  
</RequestSchema>

<StatusCodes
  {...require("./authorize-oauth-client.StatusCodes.json")}
>
  
</StatusCodes>