---
title: "Approve Endpoint"
method: POST
path: "/realms/public/protocol/openid-connect/approve"
tags: ["auth-keycloak"]
---

# Approve Endpoint

`POST /realms/public/protocol/openid-connect/approve`

Mint a single-use authorization code on the consenting user's behalf.

Called SERVER-SIDE by the portal after the human clicks "Allow". Auth is the
service-role bridge: the portal presents the service-role key + the
`X-Customer-User-Id`/`X-Customer-Org-Id` delegation headers, which
`get_current_user` resolves (and `_verify_delegation` confirms the user is a
member of that org) into a synthetic user-principal AuthUser. The user's
Supabase JWT itself is never forwarded to mint the code — identity is
asserted via the trusted bridge.

Body: {client_id, redirect_uri, response_type:'code', scope, state,
       code_challenge, code_challenge_method:'S256'}.
Returns 200 {code, redirect_uri, state}; the portal 302s the browser to
`{redirect_uri}?code=..&state=..`.

## Request body

- object

## Response `200`

Successful Response

- unknown

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `422` — Validation Error
- `500` — Internal Server Error

---

[API](https://skmtc.dev/geopera/apis/geopera-data-platform.md) · [All operations](https://skmtc.dev/geopera/apis/geopera-data-platform/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/geopera/geopera-data-platform/revisions/27294869ca25/schema)