> ## Documentation Index
> Fetch the complete documentation index at: https://docs.member.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Oauth Authorize Resume

> Resume a cold-start authorization request after the member logs in.

SECURITY INVARIANTS:
- The ONLY accepted parameters are the opaque single-use ``rid`` and the
  non-secret hub slug ``h``.  This endpoint never accepts a redirect_uri,
  return_to, next, client_id, scope, state, nonce, or PKCE value — there is
  no client-controlled redirect target, so there is no open-redirect surface.
  ``h`` is used ONLY as a percent-encoded path segment on the server-configured
  HUB_FRONTEND_BASE_URL origin (app/hubs/urls.py:66), never as a host or a
  full URL.
- The rid is burned atomically (GET+DEL) on first read: it cannot be replayed.
- Identity comes ONLY from the live session resolved at THIS request; the
  stored context carries no contact_id, so a resume link cannot fixate a
  contact.
- The full /authorize validation ladder re-runs; nothing is trusted as
  pre-validated.

This is an OAuth2/OIDC endpoint — NOT JSON:API.



## OpenAPI

````yaml /openapi/mio-openapi.json get /oauth/authorize/resume
openapi: 3.1.0
info:
  description: >-
    Production API reference for Membership.io. Use the authored guides for
    workflows and the generated endpoint pages for exact parameters and schemas.
  title: Membership.io API
  version: 0.1.0
servers:
  - description: Production
    url: https://api.member.dev
security:
  - bearerAuth: []
paths:
  /oauth/authorize/resume:
    get:
      tags:
        - oauth
      summary: Oauth Authorize Resume
      description: >-
        Resume a cold-start authorization request after the member logs in.


        SECURITY INVARIANTS:

        - The ONLY accepted parameters are the opaque single-use ``rid`` and the
          non-secret hub slug ``h``.  This endpoint never accepts a redirect_uri,
          return_to, next, client_id, scope, state, nonce, or PKCE value — there is
          no client-controlled redirect target, so there is no open-redirect surface.
          ``h`` is used ONLY as a percent-encoded path segment on the server-configured
          HUB_FRONTEND_BASE_URL origin (app/hubs/urls.py:66), never as a host or a
          full URL.
        - The rid is burned atomically (GET+DEL) on first read: it cannot be
        replayed.

        - Identity comes ONLY from the live session resolved at THIS request;
        the
          stored context carries no contact_id, so a resume link cannot fixate a
          contact.
        - The full /authorize validation ladder re-runs; nothing is trusted as
          pre-validated.

        This is an OAuth2/OIDC endpoint — NOT JSON:API.
      operationId: oauth.get_oauth_get_oauth_authorize_resume
      parameters:
        - in: query
          name: rid
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: Rid
        - in: query
          name: h
          required: false
          schema:
            anyOf:
              - type: string
              - type: 'null'
            title: H
      responses:
        '200':
          content:
            application/vnd.api+json:
              schema: {}
          description: Successful Response
        '302':
          description: >-
            Redirect: to the RP's redirect_uri with code/error, to the hub
            consent page, or to the hub login page when the link is dead
        '400':
          description: Expired or already-used resume link with no recoverable hub
        '404':
          description: >-
            Cold-start bounce is disabled (OAUTH_COLDSTART_BOUNCE_ENABLED=false)
            — this endpoint behaves as if it does not exist
        '422':
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
      security:
        - HTTPBearer: []
components:
  schemas:
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          title: Detail
          type: array
      title: HTTPValidationError
      type: object
    ValidationError:
      properties:
        ctx:
          title: Context
          type: object
        input:
          title: Input
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          title: Location
          type: array
        msg:
          title: Message
          type: string
        type:
          title: Error Type
          type: string
      required:
        - loc
        - msg
        - type
      title: ValidationError
      type: object
  securitySchemes:
    bearerAuth:
      bearerFormat: JWT or mio_sk API key
      description: >-
        Send platform JWTs, contact JWTs, or team API keys as `Authorization:
        Bearer <token>`.
      scheme: bearer
      type: http
    HTTPBearer:
      scheme: bearer
      type: http

````