---
title: "Begin per-user OAuth consent for an oauth_passthrough connection."
method: GET
path: "/v1/connections/{id}/oauth/authorize"
tags: ["connections"]
---

# Begin per-user OAuth consent for an oauth_passthrough connection.

`GET /v1/connections/{id}/oauth/authorize`

## Request

- Base URL: `http://localhost:8080`
- URL: `http://localhost:8080/v1/connections/{id}/oauth/authorize`
- Auth: one of:
  - API key in cookie `dvt_session`
  - HTTP bearer

Starts the per-user warehouse OAuth flow (DVT-123): mints a PKCE verifier + CSRF
state, seals them (with the caller's identity) into a short-lived cookie, and
redirects the browser to the connection's configured IdP authorize endpoint. Unlike
the admin connection-metadata endpoints, consent is a **per-user self-service**
action available to any member — each user grants only their OWN warehouse identity.

This is a top-level browser navigation, not an XHR (it ends in a cross-site redirect).
On the IdP callback the code is exchanged for the user's refresh token, stored
envelope-encrypted in `user_connection_grants`. Only valid for an `oauth_passthrough`
connection whose admin has configured the `oauth` block and stored the client secret.

## Other responses

- `302`: Redirect to the IdP consent screen.
- `400`: Connection is not oauth_passthrough, or is not OAuth-configured yet.
- `401`: Missing, invalid, or expired session.
- `404`: Resource does not exist.

---

[API](https://skmtc.dev/dvt/apis/dvt-rest-api.md) · [All operations](https://skmtc.dev/dvt/apis/dvt-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dvt/apis/dvt-rest-api/revisions/00016f504165?raw)