---
title: "Authorization endpoint"
method: GET
path: "/oauth/authorize"
tags: ["OAuth"]
---

# Authorization endpoint

`GET /oauth/authorize`

## Request

- Base URL: `https://api.infolang.ai`
- URL: `https://api.infolang.ai/oauth/authorize`
- Auth: none declared

Validates the request and redirects the browser to the console's consent screen.

**PKCE is mandatory.** `code_challenge` and `code_challenge_method=S256` are required for every client, public or confidential; a request without them is refused.

**Error handling is in two phases, and the order is a security property.** A bad or unknown `client_id`, or a `redirect_uri` that is not an exact match for one this client registered, is reported DIRECTLY as a 400 — redirecting there would mean redirecting to a URI that just failed validation, which is an open redirect. Every later failure (`unsupported_response_type`, missing PKCE, `invalid_scope`) redirects back to the now-validated `redirect_uri` as `?error=…&error_description=…&state=…`, per RFC 6749 §4.1.2.1. Public — no credential. That is not an oversight: a client cannot authenticate before it has a token, which is the entire purpose of this surface.

## Query parameters

- `response_type` 'code', required
- `client_id` string, required
- `redirect_uri` string: Required unless the client registered exactly one URI
- `code_challenge` string, required: PKCE, required
- `code_challenge_method` 'S256', required
- `state` string
- `scope` string: Space-delimited

## Other responses

- `302`: Redirect to the consent screen, or an error redirect
- `400`: Unknown client_id or unregistered redirect_uri — never redirected

---

[API](https://skmtc.dev/infolang/apis/infolang-api.md) · [All operations](https://skmtc.dev/infolang/apis/infolang-api/llms.txt) · [OpenAPI document](https://skmtc.dev/infolang/apis/infolang-api/revisions/d04bf6de72c8?raw)