---
title: "OAuth authorization endpoint redirect proxy"
method: GET
path: "/oauth/authorize"
tags: ["OAuth", "MCP"]
---

# OAuth authorization endpoint redirect proxy

`GET /oauth/authorize`

## Request

- Base URL: `https://api.apphandoff.com/api`
- URL: `https://api.apphandoff.com/api/oauth/authorize`
- Auth: none required

Redirects to Supabase `/auth/v1/oauth/authorize` while preserving the
original query string. Discovered as `authorization_endpoint` from
`/.well-known/oauth-authorization-server` so clients keep AppHandoff as
the authorization-server issuer and use the AppHandoff token proxy for
code exchange and refresh.

## Query parameters

- `client_id` string
- `redirect_uri` string, uri
- `response_type` 'code'
- `code_challenge` string
- `code_challenge_method` 'S256'
- `state` string
- `scope` string
- `resource` string, uri

## Other responses

- `302`: Redirect to Supabase authorization endpoint.
- `400`: Invalid authorization request. Error codes: - `invalid_request` — required redirect or client metadata is missing - `invalid_client` — the CIMD document is rejected or does not authorize the callback - `invalid_target` — the RFC 8707 resource is not an accepted MCP audience
- `503`: OAuth server unavailable or CIMD lookup failed (`temporarily_unavailable`).

---

[API](https://skmtc.dev/apphandoff/apis/apphandoff-api.md) · [All operations](https://skmtc.dev/apphandoff/apis/apphandoff-api/llms.txt) · [OpenAPI document](https://skmtc.dev/apphandoff/apis/apphandoff-api/revisions/9f138fe46d56?raw)