---
title: "Authorize"
method: GET
path: "/oauth/authorize"
tags: ["OAuth2"]
---

# Authorize

`GET /oauth/authorize`

Initiates OAuth authorization flow.

## Query parameters

- `client_id` string, required — Application's client ID.
- `audience` string — Identifier of the target API. Should be left empty by default.
- `scope` string — A space-separated list of permissions your app requires. Should be left empty by default.
- `response_type` 'code', required
- `redirect_uri` string, required — The URL to which Hyperline will redirect the browser after authorization has been granted by the user. It must match one of the callback URL you set when registering your app.
- `state` string, required — A random string generated by your app to prevent CSRF attacks. This value will be included in the query parameter when redirecting to the `redirect_uri` after authorizing your app.
- `resource` string — The canonical URI of the resource server (RFC 8707). For MCP clients, this should be the MCP server endpoint URL. Example: https://api.hyperline.co/mcp
- `code_challenge` string — PKCE code challenge. Required for public clients (e.g., MCP clients).
- `code_challenge_method` 'S256' | 'plain' — PKCE code challenge method. S256 is recommended for security.
- `prompt` string — OAuth prompt parameter. MCP clients send 'consent' when requesting offline_access.

## Other responses

- `302`

---

[API](https://skmtc.dev/hyperline/apis/hyperline-api.md) · [All operations](https://skmtc.dev/hyperline/apis/hyperline-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/hyperline/hyperline-api/revisions/19fa5f22e39b/schema)