OAuth

Begin an OAuth 2.0 authorization request

Public — no bearer token. Redirect your user's browser here to start the standard OAuth 2.0 authorization-code flow with PKCE (RFC 6749 + RFC 7636). code_challenge_method must be S256 — plain is rejected (RFC 9700). On success, the browser is eventually redirected back to your redirect_uri with a code (and your state, if you sent one) to exchange at POST /v1/oauth/token. On a validation failure, the browser is redirected back with error and error_description instead (RFC 6749 §4.1.2.1) — except an unknown client_id or an unregistered redirect_uri, which return 400 JSON directly rather than a redirect, since there is no verified address yet to redirect to.

get/v1/oauth/authorize

Request

  • Base URL: https://api.infiniteaudience.ai
  • URL: https://api.infiniteaudience.ai/v1/oauth/authorize
  • Auth: none required

Query parameters

response_type'code' required
client_idstring required
redirect_uristring uri required
scopestring

Space-delimited API scopes (discovery, creator, MCP/A2A account-read) and MCP-only identity scopes (openid, email). email requires openid. Defaults to discovery.

resourcestring uri

RFC 8707 resource URI. Required for public MCP/A2A clients. A pre-registered confidential client that omits it receives a REST-bound token.

statestring

Opaque value echoed back on both the success and error redirects.

noncestring

OIDC nonce echoed in the authorization-code ID token when openid is granted.

code_challengestring required
code_challenge_method'S256' required

Changes

No recorded changes to this operation across all 1 revision of this API.