Authorize
The browser entry point for the authorization-code flow. This is a redirect target, not something to call from code.
Any client may sign in without registering first by using a Client ID
Metadata Document: make client_id an https URL that serves your
client's metadata as JSON, naming that same URL as its client_id,
with token_endpoint_auth_method none and your redirect_uris. An
https redirect URI must be on the same origin as the client_id; a
loopback one (http://127.0.0.1, http://[::1], http://localhost)
matches on any port. Such a client is granted apikeys.use at most. A
client registered at /oauth/register uses the client_id it was
given and one of the redirect_uris it registered.
An unknown client_id or an unregistered redirect_uri is shown to the
person and never redirected, because sending an error to an address we
have not verified belongs to you is how an open redirector works. Any
other error in the request is shown to the person too: anyone can make a
client, so its redirect_uri is verified only as its own (RFC 9700
section 4.11.2). Only the person's answer comes back to your
redirect_uri: a code, or error access_denied, each with your
state and iss.
Query parameters
client_idrequiredstringredirect_urirequiredstringresponse_typerequired"code"code_challengerequiredstringcode_challenge_methodrequired"S256"S256, named explicitly. plain, or no method at all, is refused rather than downgraded.
scopestringstatestringReturned unchanged. Use it to bind the response to your request.
resourcestringRFC 8707. What the token is FOR, so it cannot be replayed elsewhere:
this brand's MCP server, the only resource it issues tokens for.
Anything else answers invalid_target. A client that names none is
given that server.
Responses
302
A redirect to the consent screen.
400
Shown to the person. No error in the request is sent to your redirect_uri.
429
Shown to the user. Too many authorizations from one address.