Skip to main content
GET
Oauth Authorize

Authorizations

Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Query Parameters

response_type
string | null
client_id
string | null
redirect_uri
string | null
scope
string | null
state
string | null
nonce
string | null
code_challenge
string | null
code_challenge_method
string | null
prompt
string | null

Response

Consent required — frontend must render the consent screen

Returned when the contact must approve consent before a code is issued.

consent_request_id is an OPAQUE handle to the SERVER-SIDE pending-authorize context (held in Valkey, single-use, 5-min TTL). It carries no bound params — redirect_uri / scope binding / PKCE / contact all stay server-side — so the client cannot forge or tamper with them. The frontend renders the branded consent screen from the display fields and POSTs the consent_request_id back.

client_name
string
required
scope
string[]
required
brand_label
string | null
logo_url
string | null