---
title: "Oauth Approve Status"
method: GET
path: "/oauth/approve-status"
---

# Oauth Approve Status

`GET /oauth/approve-status`

## Request

- Base URL: `https://api.local-mcp.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.local-mcp.com/oauth/approve-status`
- Auth: none declared

Authorize-page polling: pending|approved (+redirect_url once approved).
The redirect_url only ever targets the client's REGISTERED redirect_uri.

lmcp-api#272: the page that opened /oauth/authorize holds a poll secret (`poll`; only its
sha256 is on the nonce row, and the deep link never carries it). With
LMCP_OAUTH_POLL_BINDING=1 the code goes only to that secret: any other poll reads `pending`
(no oracle), so whoever holds just the nonce cannot collect the code. Off until the 3.0.421
Mac auto-connect sends it; meanwhile an unbound collection is counted
(`oauth_approve_status_unbound`, no address). A nonce minted before this change has no hash.

A collected row is kept as 'collected' until it expires (no longer deleted), so the tray's
retry of /oauth/tray-approve still answers ok. The same page may read the same redirect again
only when ITS secret made the first collection (`collected_bound`, review B3); any other
reader of a collected row gets `expired`, as before.

## Query parameters

- `nonce` string
- `poll` string

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/local-mcp/apis/lmcp-api.md) · [All operations](https://skmtc.dev/local-mcp/apis/lmcp-api/llms.txt) · [OpenAPI document](https://skmtc.dev/local-mcp/apis/lmcp-api/revisions/f1f1c502623a?raw)