> ## Documentation Index
> Fetch the complete documentation index at: https://docs.member.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Oauth Consent

> Consent submission endpoint.

The frontend submits the opaque ``consent_request_id`` obtained from
GET /oauth/authorize (when consent_required=true) after the contact approves.
The server-side pending context is atomically burned (single-use), re-verified
(contact match + redirect_uri still registered + scope still allowed), then the
grant is persisted and the authorization code redirect is issued.  The client
cannot influence redirect_uri / scope / contact via this body.

Requires an active contact session (Bearer token).

This is an OAuth2/OIDC standard endpoint — NOT JSON:API.



## OpenAPI

````yaml /openapi/mio-openapi.json post /oauth/consent
openapi: 3.1.0
info:
  description: >-
    Production API reference for Membership.io. Use the authored guides for
    workflows and the generated endpoint pages for exact parameters and schemas.
  title: Membership.io API
  version: 0.1.0
servers:
  - description: Production
    url: https://api.member.dev
security:
  - bearerAuth: []
paths:
  /oauth/consent:
    post:
      tags:
        - oauth
      summary: Oauth Consent
      description: >-
        Consent submission endpoint.


        The frontend submits the opaque ``consent_request_id`` obtained from

        GET /oauth/authorize (when consent_required=true) after the contact
        approves.

        The server-side pending context is atomically burned (single-use),
        re-verified

        (contact match + redirect_uri still registered + scope still allowed),
        then the

        grant is persisted and the authorization code redirect is issued.  The
        client

        cannot influence redirect_uri / scope / contact via this body.


        Requires an active contact session (Bearer token).


        This is an OAuth2/OIDC standard endpoint — NOT JSON:API.
      operationId: oauth.post_oauth_post_oauth_consent
      requestBody:
        content:
          application/vnd.api+json:
            schema:
              $ref: '#/components/schemas/_ConsentRequest'
        required: true
      responses:
        '302':
          content:
            application/vnd.api+json:
              schema: {}
          description: Successful Response
        '422':
          content:
            application/vnd.api+json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
          description: Validation Error
      security:
        - HTTPBearer: []
components:
  schemas:
    _ConsentRequest:
      description: >-
        Body for POST /oauth/consent.


        Carries ONLY the opaque consent_request_id.  The client cannot supply

        redirect_uri / scope / contact here — those are read from the
        server-side

        context keyed by this id and re-verified before a code is minted.
      properties:
        consent_request_id:
          title: Consent Request Id
          type: string
      required:
        - consent_request_id
      title: _ConsentRequest
      type: object
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          title: Detail
          type: array
      title: HTTPValidationError
      type: object
    ValidationError:
      properties:
        ctx:
          title: Context
          type: object
        input:
          title: Input
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          title: Location
          type: array
        msg:
          title: Message
          type: string
        type:
          title: Error Type
          type: string
      required:
        - loc
        - msg
        - type
      title: ValidationError
      type: object
  securitySchemes:
    bearerAuth:
      bearerFormat: JWT or mio_sk API key
      description: >-
        Send platform JWTs, contact JWTs, or team API keys as `Authorization:
        Bearer <token>`.
      scheme: bearer
      type: http
    HTTPBearer:
      scheme: bearer
      type: http

````