OAuth

Authorization endpoint (Authorization Code + PKCE)

Browser endpoint, not an API call - send the user here to obtain consent for a registered OAuth client. Signed-out users are bounced through login first. On approval it redirects to redirect_uri with ?code= (and ?state=); protocol errors (unsupported_response_type, invalid_request for a missing/non-S256 challenge, invalid_scope) redirect back with ?error=. An unknown client_id or an unregistered redirect_uri cannot be redirected and answers a plain-text 400 instead. PKCE S256 is mandatory; authorization codes are single-use and valid for 5 minutes.

get/oauth/authorize

Request

  • Base URL: https://everypage.co
  • URL: https://everypage.co/oauth/authorize
  • Auth: none required

Query parameters

response_type'code' required

Always code.

client_idstring required

The registered OAuth client id (epc_...).

redirect_uristring required

Must exactly match a redirect URI registered for the client.

scopestring required

Space-delimited; every scope must be allowed for the client.

statestring

Opaque CSRF value echoed back on the redirect.

code_challengestring required

PKCE challenge (RFC 7636).

code_challenge_method'S256' required

Only S256 is accepted.

Changes

No recorded changes to this operation across all 1 revision of this API.