---
title: "Authorization endpoint (Authorization Code + PKCE)"
method: GET
path: "/oauth/authorize"
tags: ["OAuth"]
---

# Authorization endpoint (Authorization Code + PKCE)

`GET /oauth/authorize`

## Request

- Base URL: `https://everypage.co`
- URL: `https://everypage.co/oauth/authorize`
- Auth: none required

Browser endpoint, not an API call - send the user here to obtain consent for a registered OAuth client. Signed-out users are bounced through login first. On approval it redirects to `redirect_uri` with `?code=` (and `?state=`); protocol errors (`unsupported_response_type`, `invalid_request` for a missing/non-S256 challenge, `invalid_scope`) redirect back with `?error=`. An unknown `client_id` or an unregistered `redirect_uri` cannot be redirected and answers a plain-text 400 instead. PKCE S256 is mandatory; authorization codes are single-use and valid for 5 minutes.

## Query parameters

- `response_type` 'code', required
- `client_id` string, required
- `redirect_uri` string, required
- `scope` string, required
- `state` string
- `code_challenge` string, required
- `code_challenge_method` 'S256', required

## Other responses

- `302`: Redirect to the consent screen, login, or back to redirect_uri with code/error.
- `400`: Unknown OAuth client, or a `redirect_uri` that is not registered for the client. Plain text - there is no trusted redirect target to send the error to.

---

[API](https://skmtc.dev/everypage/apis/everypage-api.md) · [All operations](https://skmtc.dev/everypage/apis/everypage-api/llms.txt) · [OpenAPI document](https://skmtc.dev/everypage/apis/everypage-api/revisions/e6674f903456?raw)