---
title: "Start an authorization (browser)"
method: GET
path: "/oauth/authorize"
tags: ["OAuth"]
---

# Start an authorization (browser)

`GET /oauth/authorize`

## Request

- Base URL: `https://api.honkio.ca`
- URL: `https://api.honkio.ca/oauth/authorize`
- Auth: none required

OAuth 2.1 authorization endpoint. Sends the user to the HonkIO consent screen, then back to redirect_uri with a code. PKCE S256 is required. Client ids may be Client ID Metadata Document URLs (https), dynamically registered ids, or pre-registered ids. A request that fails validation is answered with an error page; it is redirected back with an error only when redirect_uri is loopback or the client is pre-registered.

## Query parameters

- `response_type` string
- `client_id` string
- `redirect_uri` string
- `scope` string
- `state` string
- `code_challenge` string
- `code_challenge_method` string
- `resource` string

## Other responses

- `302`: Redirect to the consent screen. A request that fails validation is redirected back to redirect_uri with an error, state and iss only when that URI is loopback or the client is pre-registered.
- `400`: An HTML page (never a redirect) when client_id or redirect_uri cannot be trusted, when state is longer than 512 characters, or when a dynamically registered or metadata-document client sends a request that fails validation with a redirect_uri that is not loopback.
- `429`: slow_down: 30 requests a minute from one address.

---

[API](https://skmtc.dev/honkio/apis/honkio-api.md) · [All operations](https://skmtc.dev/honkio/apis/honkio-api/llms.txt) · [OpenAPI document](https://skmtc.dev/honkio/apis/honkio-api/revisions/ce4ed3fe9691?raw)