---
title: "Authorize"
method: GET
path: "/api/v1/oauth/authorize"
tags: ["OAuth"]
---

# Authorize

`GET /api/v1/oauth/authorize`

Authorize an MCP client against the currently-signed-in app user.

Fast path: if the browser sends our `humwork_refresh_token` cookie, the
user is already signed into our app — exchange the refresh token at
Auth0, identify the user, mint an MCP code for THEIR API key, and
redirect straight to /oauth/success. No Auth0 prompt. This guarantees
"whichever account is signed into our app gets the API key."

Slow path (no cookie or refresh failed): redirect to Auth0 Universal
Login. Auth0 calls back into /oauth/callback which then mints the code.

## Query parameters

- `client_id` string, required
- `redirect_uri` string, required
- `response_type` string, required
- `code_challenge` string, required
- `code_challenge_method` string, required
- `state` string, required
- `scope` string, nullable

## Response `200`

Successful Response

- unknown

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.dev/humwork/apis/humwork-ai.md) · [All operations](https://skmtc.dev/humwork/apis/humwork-ai/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/humwork/humwork-ai/revisions/38d9dc5f27e6/schema)