---
title: "Generate OAuth authorization URL"
method: GET
path: "/api/oauth/auth-url"
tags: ["oauth"]
---

# Generate OAuth authorization URL

`GET /api/oauth/auth-url`

Generate OAuth authorization URL with state and nonce for CSRF and replay attack protection. State is stored with TTL for validation.

## Query parameters

- `redirect_uri` string, required — The URI to redirect to after OAuth consent. Must match the registered redirect URI in OAuth client configuration.
- `code_challenge` string, nullable — PKCE code challenge derived from code_verifier. Required for public clients to prevent authorization code interception attacks.
- `code_challenge_method` string, nullable — PKCE code challenge method, typically 'S256' (SHA-256 hash). Must be provided if code_challenge is specified.

## Response `200`

Successful Response

- AuthUrlResponse — Response containing OAuth authorization URL
  - `url` string, uri, required — OAuth provider authorization URL to redirect the user to for consent

## Other responses

- `422` — Validation Error
- `429` — Rate limit exceeded. Retry after the interval in the `Retry-After` header.

## Changes

- **2026-08-08** `815e0302a988` — 1 breaking, 1 info
  - response property `detail` list-of-types was widened by adding types `string` to media type `application/json` of response `422`
  - the response property `detail` became required for the status `422`
- **2026-08-05** `c3e15c78f2da` — 1 info
  - added the non-success response with the status `429`
- **2026-08-05** `6397cb5a99c5` — 1 info
  - api operation id `get_auth_url_api_oauth_auth_url_get` removed and replaced with `get_auth_url`

[Change history](https://skmtc.dev/gumnut-ai/apis/gumnut-api/changes/api/oauth/auth-url/get.md)

---

[API](https://skmtc.dev/gumnut-ai/apis/gumnut-api.md) · [All operations](https://skmtc.dev/gumnut-ai/apis/gumnut-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/gumnut-ai/gumnut-api/revisions/2c3aca3a6e6d/schema)