---
title: "[cloud-only] Begin or resume an OAuth 2.1 authorization request"
method: GET
path: "/oauth/authorize"
tags: ["auth"]
---

# \[cloud-only\] Begin or resume an OAuth 2.1 authorization request

`GET /oauth/authorize`

[cloud-only] Two modes:
- **Initial entry** (OAuth params present): validates client/redirect/resource/scopes, persists a server-side authorization-request row, and either redirects (no session / unverified email) to the configured frontend login URL carrying only the opaque `oauth_request_id`, or returns the JSON consent challenge for the frontend to render.
- **Resume** (`oauth_request_id` present): loads the server-side row, fails closed if expired/consumed/unknown, returns the JSON consent challenge. Browser-replayed OAuth params are intentionally ignored.

The frontend renders the consent UI from the JSON payload and POSTs the user's decision back to this endpoint.

## Query parameters

- `response_type` string
- `client_id` string
- `redirect_uri` string
- `scope` string
- `state` string
- `code_challenge` string
- `code_challenge_method` string
- `resource` string
- `oauth_request_id` string

## Response `200`

Consent challenge payload (session present, email verified). Frontend renders the consent UI from this payload and POSTs back to /oauth/authorize.

- OAuthConsentChallenge — [cloud-only] Server-side state describing the OAuth consent decision the user is being asked to make. Returned by GET /oauth/authorize when a valid session exists; the frontend renders the consent UI from this payload and POSTs the decision back. Browser never sees the original OAuth params on resume.
  - `oauth_request_id` string, uuid, required — Opaque server-side identifier for the authorization-request row. Carried back unchanged in the consent submission.
  - `csrf_token` string, required — Per-row CSRF token bound to this authorization request (not to the session). Must be echoed back on POST.
  - `client_display_name` string, required — Human-readable name of the OAuth client requesting authorization.
  - `resource_display_name` string, required — Human-readable name of the protected resource.
  - `scopes` string[], required — Scopes the client is requesting for this resource. The frontend should present these for the user to approve.
  - `workspaces` OAuthConsentChallengeWorkspace[], required — Workspaces the user can select from. Membership is re-checked on POST.
    - `id` string, required
    - `name` string, required
    - `type` 'personal' | 'team', required
    - `role` 'owner' | 'member', required

## Other responses

- `302` — Redirect to login (no session / unverified email) or to registered redirect_uri (pre-validated client error)
- `400` — Invalid authorize request (pre-redirect failure — unknown client, redirect mismatch, malformed params)
- `404` — OAuth disabled

## Changes

- **2026-05-21** `eda7dd3d95f1` — 1 info
  - endpoint added

[Change history](https://skmtc.dev/comfy-org/apis/comfyui-api/changes/oauth/authorize/get.md)

---

[API](https://skmtc.dev/comfy-org/apis/comfyui-api.md) · [All operations](https://skmtc.dev/comfy-org/apis/comfyui-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/comfy-org/comfyui-api/revisions/c4db9e1283df/schema)