---
title: "Validate an MCP OAuth consent request"
method: POST
path: "/oauth/consent/preview"
tags: ["MCP"]
---

# Validate an MCP OAuth consent request

`POST /oauth/consent/preview`

## Request

- Base URL: `https://api.medianfi.com/api/v1`
- URL: `https://api.medianfi.com/api/v1/oauth/consent/preview`
- Auth: HTTP bearer

Requires a signed-in human Bearer session and MCP_OAUTH_ENABLED. Validates the current registered client, exact approved callback, MCP resource and canonical PKCE S256 challenge before returning display metadata. Does not grant access or issue an authorization code. Approval independently checks the request and current company authority again. The stored client_name is a self-asserted connector label, not verified publisher identity.

## Request body

- object
  - `client_id` string, required
  - `redirect_uri` string, uri, required
  - `code_challenge` string, required
  - `code_challenge_method` 'S256', required
  - `resource` string, uri, required
  - `scope` string
  - `state` string

## Response `200`

Validated consent display data, with no grant or code created

- object
  - `success` true, required
  - `data` object, required
    - `client_name` string, nullable, required: Stored self-asserted DCR label; does not attest publisher identity
    - `redirect_uri` string, uri, required
    - `issuer` string, uri, required: Exact OAuth metadata issuer, including any trailing slash
    - `resource` string, uri, required
    - `scopes` string[], required

## Other responses

- `400`: Unknown, revoked or unapproved client, callback mismatch or resource mismatch
- `401`: Missing or invalid human Bearer session
- `403`: API-key authentication cannot authorize a connector
- `404`: MCP OAuth is disabled
- `422`: Missing or invalid consent parameters, including malformed PKCE

---

[API](https://skmtc.dev/medianfi/apis/median-api.md) · [All operations](https://skmtc.dev/medianfi/apis/median-api/llms.txt) · [OpenAPI document](https://skmtc.dev/medianfi/apis/median-api/revisions/20090ea32b0d?raw)