COcoder
Enterprise

OAuth2 authorization request (GET - show authorization page).

Changed on
get/oauth2/authorize

Request

  • Base URL
    / (relative, and the document was published on a file host, not at the API’s origin)
  • URL
    /oauth2/authorize
  • Auth
    API key in header Coder-Session-Token

Query parameters

client_idstring required

Client ID

statestring

A random unguessable string, echoed back on the callback

response_type'code' required

Response type

redirect_uristring

Redirect here after authorization

scopestring

Space-separated scopes to request. Each must be supported by this deployment, and the app's allowlist, when it has one, must cover the permissions requested rather than name each scope. Defaults to that allowlist, or to coder:all for an app with no allowlist

code_challengestring required

PKCE code challenge, 43 to 128 characters from [A-Za-z0-9-._~] (RFC 7636)

code_challenge_method'S256'

PKCE challenge method. S256 only; omitting it means S256

resourcestring

RFC 8707 resource indicator: an absolute URI without a fragment

Response

Returns HTML authorization page

Changes

  • c7e1f250ece7Revision changes
    • breaking

      added the new required query request parameter code_challenge

    • info

      added the new optional query request parameter code_challenge_method

    • info

      added the new optional query request parameter resource

    • info

      the query request parameter state became optional

    • info

      added the non-success response with the status

    • info

      added the non-success response with the status

  • da2d760560c1Revision changes
    • info

      added the non-success response with the status