---
title: "Authorize Endpoint"
method: GET
path: "/realms/public/protocol/openid-connect/auth"
tags: ["auth-keycloak"]
---

# Authorize Endpoint

`GET /realms/public/protocol/openid-connect/auth`

OAuth 2.0 authorization endpoint (auth-code + PKCE).

Validates the request, then 302-redirects the BROWSER to the portal consent
page carrying the validated params. This endpoint does NOT authenticate the
user — the portal holds the human session and drives /approve.

Errors that can't be safely redirected (bad/missing client_id or
redirect_uri) → 400. All other errors AFTER redirect_uri is validated →
302 back to redirect_uri?error=.. (RFC 6749 §4.1.2.1).

## Query parameters

- `response_type` string, nullable
- `client_id` string, nullable
- `redirect_uri` string, nullable
- `scope` string, nullable
- `state` string, nullable
- `code_challenge` string, nullable
- `code_challenge_method` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `422` — Validation Error
- `500` — Internal Server Error

---

[API](https://skmtc.dev/geopera/apis/geopera-data-platform.md) · [All operations](https://skmtc.dev/geopera/apis/geopera-data-platform/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/geopera/geopera-data-platform/revisions/cb0130b2a40a/schema)