---
title: "Start an agent authorization (code with PKCE)"
method: GET
path: "/oauth/agent/authorize"
tags: ["Agents"]
---

# Start an agent authorization (code with PKCE)

`GET /oauth/agent/authorize`

## Request

- Base URL: `https://api.customdomain.ai`
- URL: `https://api.customdomain.ai/oauth/agent/authorize`
- Auth: none required

The authorization endpoint. A browser is sent here by an agent; the request is validated (the client, the exact redirect URI, S256 PKCE, the scopes, the resource) and the browser is redirected to the console, where a signed in owner or admin sees what the agent asks for and where its code would go, and approves or denies. The authorization code goes to the redirect URI and is exchanged at `POST /oauth/agent/token`. A request with an unregistered or mismatched redirect URI is refused without redirecting. `client_id` is a registered client or an https URL of a Client ID Metadata Document.

## Query parameters

- `client_id` string, required
- `redirect_uri` string, uri, required
- `response_type` 'code', required
- `code_challenge` string, required
- `code_challenge_method` 'S256', required
- `scope` string, required
- `state` string
- `resource` string, uri

## Other responses

- `302`: Redirect to the console consent screen
- `400`: Error envelope: {code, title, details}.
- `503`: Error envelope: {code, title, details}.

---

[API](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api.md) · [All operations](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/llms.txt) · [OpenAPI document](https://skmtc.dev/customdomain/apis/customdomain-control-plane-api/revisions/34d89cb7a7cd?raw)