Oauth Authorize
oauth
Oauth Authorize
GET
Oauth Authorize
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Query Parameters
Response
Consent required — frontend must render the consent screen
Returned when the contact must approve consent before a code is issued.
consent_request_id is an OPAQUE handle to the SERVER-SIDE pending-authorize
context (held in Valkey, single-use, 5-min TTL). It carries no bound params —
redirect_uri / scope binding / PKCE / contact all stay server-side — so the
client cannot forge or tamper with them. The frontend renders the branded
consent screen from the display fields and POSTs the consent_request_id back.