---
title: "Start the OAuth authorization-code flow"
method: GET
path: "/api/oauth/authorize"
tags: ["OAuth 2.0 / OpenID Connect"]
---

# Start the OAuth authorization-code flow

`GET /api/oauth/authorize`

## Query parameters

- `response_type` 'code', required
- `client_id` string, required
- `redirect_uri` string, uri, required
- `scope` string, required
- `state` string, required
- `code_challenge` string
- `code_challenge_method` 'S256'
- `nonce` string
- `response_mode` 'query' | 'fragment' | 'form_post'
- `prompt` string
- `max_age` integer
- `login_hint` string

## Response `200`

HTML auto-submit response for response_mode=form_post.

## Other responses

- `303` — Redirect to the exact registered client redirect URI.
- `307` — Internal redirect to portal login or consent.
- `400` — Validation error or precondition failure.
- `401` — Missing or invalid credential.
- `403` — Credential lacks the required scope (Agent Key) or insufficient OAuth scope.
- `404` — Resource does not exist or is invisible to the caller. The two are intentionally indistinguishable.
- `409` — Conflicting state (e.g. legal-entity name already taken).
- `429` — Rate limit exceeded. No `Retry-After` header is currently emitted; back off exponentially.
- `500` — Server error.

---

[API](https://skmtc.dev/eprospera/apis/e-pro-spera-api.md) · [All operations](https://skmtc.dev/eprospera/apis/e-pro-spera-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/eprospera/e-pro-spera-api/revisions/9ecdd3ca5a8c/schema)