---
title: "Oauth Authorize"
method: POST
path: "/v1/workspaces/{workspace}/mcp-oauth/authorize"
tags: ["v1", "protected", "mcp-oauth-connect"]
---

# Oauth Authorize

`POST /v1/workspaces/{workspace}/mcp-oauth/authorize`

Initiate MCP OAuth flow and return the URL to send the user to.

1. Look up the MCP instance's remote URL
2. Discover the authorization server (RFC 9728 → RFC 8414)
3. Register dynamically (RFC 7591), or take the workspace's own OAuth app
4. Persist the client credentials on an auth config
5. Generate PKCE pair and state, and build the authorization URL

## Path parameters

- `workspace` string, required — Slug of the workspace the request acts in

## Request body

- MCPOAuthAuthorizeRequest — Start an OAuth flow for one MCP instance. ``auto`` registers AgentArea with the authorization server (RFC 7591). ``custom`` uses an OAuth app the workspace registered with the provider — the only option when the provider has no Dynamic Client Registration.
  - `client_id` string, nullable
  - `client_id_secret_id` string, uuid, nullable — Existing user-owned workspace secret containing the OAuth client ID.
  - `client_secret` string, nullable
  - `client_secret_secret_id` string, uuid, nullable — Existing user-owned workspace secret containing the OAuth client secret.
  - `credential_mode` 'auto' | 'custom'
  - `instance_id` string, uuid, required
  - `return_to` string

## Response `200`

Successful Response

- object

## Other responses

- `422` — Validation Error

## Changes

- **2026-09-26** `d3ad8e1a3681` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/agentarea/apis/agentarea-api/changes/v1/workspaces/:workspace/mcp-oauth/authorize/post.md)

---

[API](https://skmtc.dev/agentarea/apis/agentarea-api.md) · [All operations](https://skmtc.dev/agentarea/apis/agentarea-api/llms.txt) · [OpenAPI document](https://skmtc.dev/agentarea/apis/agentarea-api/revisions/286327d8bd86?raw)