---
title: "Authorization endpoint (code + PKCE S256): consent page, or redirect to /login?next=…"
method: GET
path: "/oauth/authorize"
tags: ["auth"]
---

# Authorization endpoint (code + PKCE S256): consent page, or redirect to /login?next=…

`GET /oauth/authorize`

## Request

- Base URL: `https://cliponit.app`
- URL: `https://cliponit.app/oauth/authorize`
- Auth: API key in cookie `session`

Browser endpoint. Without a web session → `303 /login?next=/oauth/authorize?…`. With a session → HTML consent page (FR/EN) naming the client and the redirect host. Unknown `client_id` or unregistered `redirect_uri` → 400 page (no redirect). Other errors are returned to `redirect_uri` as `?error=…&state=…` (RFC 6749).

## Query parameters

- `response_type` 'code', required
- `client_id` string, required
- `redirect_uri` string, uri, required
- `code_challenge` string, required
- `code_challenge_method` 'S256', required
- `state` string
- `scope` string
- `resource` string

## Response `200`

Consent page

## Other responses

- `303`: Redirect to /login (no session)
- `400`: Unknown client or unregistered redirect_uri

---

[API](https://skmtc.dev/cliponit/apis/cliponit-api.md) · [All operations](https://skmtc.dev/cliponit/apis/cliponit-api/llms.txt) · [OpenAPI document](https://skmtc.dev/cliponit/apis/cliponit-api/revisions/10e3e4327922?raw)