Sign in
OAuth

OAuth2 authorization endpoint

Changed on

Starts the OAuth2 authorization code flow (RFC 6749 §4.1). The authenticated user (resource owner) grants the requesting OAuth client access to their Aura Historia account. PKCE (RFC 7636) with S256 is required for all requests.

On success the endpoint redirects (302) to the redirect_uri appending code and, if supplied, state as query parameters. The single-use authorization code must be exchanged for an access token via POST /api/v1/oauth/token before it expires. A delegated caller must have access-tokens:write and every requested OAuth scope.

get/api/v1/oauth/authorize

Request

  • Base URL: https://api.stage.aura-historia.com
  • URL: https://api.stage.aura-historia.com/api/v1/oauth/authorize
  • Auth: HTTP bearer

Query parameters

response_type'code' required

OAuth response type. Must be code.

client_idstring required

Canonical OAuthClient ID.

redirect_uristring uri required

Redirect URI registered for the OAuth client. Must exactly match one of the client's registered redirect URIs.

scopestring

Space-separated list of requested scopes. Must be a subset of the client's allowed scopes.

statestring

Opaque client state value. Returned unchanged in the redirect to prevent CSRF attacks.

code_challengestring required

PKCE code challenge. Must be the base64url-encoded SHA256 hash of the code_verifier (S256 method).

code_challenge_method'S256' required

PKCE challenge method. Must be S256.

Changes

  • 999eda3fdd63Revision changes
    • breaking

      removed the required property / from the response with the status

    • breaking

      removed the required property / from the response with the status

    • breaking

      removed the required property / from the response with the status

    • info

      for the query request parameter client_id, the format was generalized from uuid to no format

    • info

      added the required property / to the response with the status

    • info

      added the required property / to the response with the status

    • info

      added the required property / to the response with the status