---
title: "Oauth Approve"
method: POST
path: "/oauth/approve"
---

# Oauth Approve

`POST /oauth/approve`

## Request

- Base URL: `https://api.local-mcp.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.local-mcp.com/oauth/approve`
- Auth: none declared

Deprecated by #3722: /oauth/authorize no longer renders a token-paste
form, so nothing legitimate POSTs here anymore — approval is native-tray-only,
via POST /oauth/tray-approve, which carries its own nonce (F-06's only
auth-code emitter; unaffected by this route). Any request that still reaches
this route predates that removal (a stale cached tab, a bookmark) and gets
this explicit message instead of the old PKCE 400: the removed form's hidden
fields never included code_challenge_method, so every real submit used to
fail with the misleading "Only PKCE S256 is supported" — the bug #3722 was
filed over. Checked: neither web/app/oauth/approve/route.ts (a pure proxy)
nor mac-swift/go-server post here — see #3722's PR for the sweep.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/local-mcp/apis/lmcp-api.md) · [All operations](https://skmtc.dev/local-mcp/apis/lmcp-api/llms.txt) · [OpenAPI document](https://skmtc.dev/local-mcp/apis/lmcp-api/revisions/f1f1c502623a?raw)