Sign in
auth

[cloud-only] Begin or resume an OAuth 2.1 authorization request

[cloud-only] Two modes:

  • Initial entry (OAuth params present): validates client/redirect/resource/scopes, persists a server-side authorization-request row, and either redirects (no session / unverified email) to the configured frontend login URL carrying only the opaque oauth_request_id, or returns the JSON consent challenge for the frontend to render.
  • Resume (oauth_request_id present): loads the server-side row, fails closed if expired/consumed/unknown, returns the JSON consent challenge. Browser-replayed OAuth params are intentionally ignored.

The frontend renders the consent UI from the JSON payload and POSTs the user's decision back to this endpoint.

get/oauth/authorize

Query parameters

response_typestring
client_idstring
redirect_uristring
scopestring
statestring

RFC 6749 §10.12 marks state as RECOMMENDED. Cloud hardening makes it REQUIRED on the initial-entry path (omitted only on the resume path where oauth_request_id is supplied instead). This parameter is required: false at the spec level only because the operation is dual-mode (initial entry vs. resume); the runtime rejects empty state on the initial-entry path with a stable invalid_request 400.

code_challengestring
code_challenge_methodstring
resourcestring
oauth_request_idstring

Response

Consent challenge payload (session present, email verified). Frontend renders the consent UI from this payload and POSTs back to /oauth/authorize.

oauth_request_idstring uuid required

Opaque server-side identifier for the authorization-request row. Carried back unchanged in the consent submission.

csrf_tokenstring required

Per-row CSRF token bound to this authorization request (not to the session). Must be echoed back on POST.

client_display_namestring required

Human-readable name of the OAuth client requesting authorization.

resource_display_namestring required

Human-readable name of the protected resource.

scopesstring[] required

Scopes the client is requesting for this resource. The frontend should present these for the user to approve.

Changes