---
title: "Discover Masko CLI browser authorization"
method: GET
path: "/v1/auth/config"
tags: ["Authentication"]
---

# Discover Masko CLI browser authorization

`GET /v1/auth/config`

## Request

- Base URL: `https://api.masko.ai`
- URL: `https://api.masko.ai/v1/auth/config`
- Auth: none required

The registered masko-cli client opens authorization_endpoint with response_type=code, client_id=masko-cli, device_name, scope read/write, redirect_uri, state, code_challenge, and code_challenge_method=S256. Only http://127.0.0.1:PORT/oauth/callback with port 1024..65535 is accepted. Use independent random verifier and state values with at least 32 random bytes; state is echoed and must be checked by the CLI. Browser sign-in and explicit workspace approval return a one-time code, never access or refresh tokens. This is Masko JSON transport, not general OAuth server discovery.

## Response `200`

Configuration. Cache-Control: no-store.

- object
  - `data` object, required
    - `authorization_endpoint` string, uri, required
    - `code_challenge_methods_supported` string[], required
    - `grant_types_supported` string[], required

---

[API](https://skmtc.dev/masko/apis/masko-api.md) · [All operations](https://skmtc.dev/masko/apis/masko-api/llms.txt) · [OpenAPI document](https://skmtc.dev/masko/apis/masko-api/revisions/91eb3006a92f?raw)