---
title: "Start a first-party sign-in (authorization code + PKCE)"
method: GET
path: "/v1/oauth/authorize"
tags: ["auth"]
---

# Start a first-party sign-in (authorization code + PKCE)

`GET /v1/oauth/authorize`

## Request

- Base URL: `https://api.flowral.app`
- URL: `https://api.flowral.app/v1/oauth/authorize`
- Auth: none required

Browser-facing, not meant to be called by anything but a user-agent. Validates the request and redirects to the Flowral app's own sign-in screen; once the person signs in and allows the connection there, the app redirects on to `redirect_uri` with a one-time `code`. POST /oauth/token's `authorization_code` grant exchanges it for a token. `client_id` must name a registered first-party client (currently `flowral-vscode`) and `redirect_uri` must be a loopback address it owns.

## Query parameters

- `client_id` string, required
- `redirect_uri` string, required: A loopback address, e.g. `http://127.0.0.1:<port>/callback`.
- `response_type` string, required: Must be `code`.
- `code_challenge` string, required: PKCE, S256 of a code_verifier the client keeps.
- `code_challenge_method` string, required: Must be `S256`.
- `state` string
- `scope` string: Space-separated. Defaults to everything the signed-in person can do; naming scopes here can only narrow it.

## Other responses

- `302`: Redirects to the app's sign-in screen.

---

[API](https://skmtc.dev/flowral/apis/flowral-api.md) · [All operations](https://skmtc.dev/flowral/apis/flowral-api/llms.txt) · [OpenAPI document](https://skmtc.dev/flowral/apis/flowral-api/revisions/6cd2337b682c?raw)