---
title: "Start provider OAuth connect"
method: POST
path: "/api/provider-connections/oauth/authorize"
tags: ["provider_connections"]
---

# Start provider OAuth connect

`POST /api/provider-connections/oauth/authorize`

## Request

- Base URL: `https://beta.getsales.io/integrations/v1`
- URL: `https://beta.getsales.io/integrations/v1/api/provider-connections/oauth/authorize`
- Auth: HTTP bearer and API key in header `Team-SID`

Leg 1 of connecting HubSpot: mint the consent URL to open in a browser and a signed state (15 minutes, single-use). Nothing is written: a connection exists only once a grant does. The browser lands in the app, which relays the code and the state to complete_provider_connection_oauth. 422 oauth_app_not_configured on a plane without the HubSpot app.

Contract:
- MCP tool `start_provider_connection_oauth`, registry package `mcp.integrations/provider_connections`, mount `integrations.providers`.
- Operation `action`, response envelope `action`.
- Flags: none.

## Request body

- StartProviderConnectionOauthRequest: Request body of `start_provider_connection_oauth`.
  - `provider` 'hubspot', required: hubspot.

## Response `200`

`action` success envelope.

- StartProviderConnectionOauthResponse
  - `success` true, required
  - `operation` 'action', required
  - `action` string, required: kebab-case verb; matches the route segment.
  - `item` unknown, required
  - `result` object, required
    - `authorize_url` string, required: The provider's consent screen, state embedded.
    - `state` string, required: Hand it back verbatim at completion.
    - `expires_at` string, required: ISO 8601 UTC when the leg lapses.
  - `meta` object, required
    - `trace_id` string, required: UUID v7; same 128-bit value as the X-Trace-Id header.
    - `span_id` string, required: 16 hex chars, root span of this request.
    - `timestamp` string, required: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
    - `duration_ms` integer, required: Server-side wall clock.
    - `team_sid` string, nullable: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends.
    - `actor_type` string, nullable: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends.

## Other responses

- `4XX`: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented.
- `5XX`: MCP error envelope with `error.code` internal_error or service_unavailable.

---

[API](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-integrations.md) - [All operations](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-integrations/llms.txt) - [OpenAPI document](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-integrations/revisions/2e7105d58335?raw)