---
title: "Grant Authorization"
method: POST
path: "/api/oauth/authorize"
tags: ["oauth"]
---

# Grant Authorization

`POST /api/oauth/authorize`

## Request

- Base URL: `https://kernelscan.io`
- URL: `https://kernelscan.io/api/oauth/authorize`
- Auth: none declared

Mint an authorization code for the signed-in user.

Authenticated with the user's own JWT (the consent page sends it from
localStorage), so the identity being granted is unambiguous and no
cross-site form can trigger it.

The code stores the redirect_uri exactly as presented (for a CIMD loopback
redirect that includes the ephemeral port), and /oauth/token demands that
same string.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/kernelscan/apis/kernelscan-api.md) · [All operations](https://skmtc.dev/kernelscan/apis/kernelscan-api/llms.txt) · [OpenAPI document](https://skmtc.dev/kernelscan/apis/kernelscan-api/revisions/4fa51d41484e?raw)