Sign in
auth

[cloud-only] Submit OAuth consent decision

[cloud-only] JSON-only consent submission. The handler verifies the per-row CSRF token, atomically marks the authorization request consumed (single-use covers both allow and deny paths), then returns the redirect URL the browser must navigate to. The URL contains either code + original state for allow, or the RFC 6749 §5.2 error and state for deny.

Workspace membership is re-checked at submission time. Consent is persisted keyed by (user_id, client_id, resource_id, workspace_id); broadening the previously approved scope set requires a fresh consent flow.

post/oauth/authorize

Request body

oauth_request_idstring uuid required
csrf_tokenstring required
decision'allow' | 'deny' required
workspace_idstring required

Response

Redirect URL for the frontend to navigate to (allow → with code+state; deny → with error+state)

redirect_urlstring uri required

OAuth client redirect URI with either code+state for allow, or error+state for deny.

Changes