---
title: "Authorize"
method: GET
path: "/oauth/authorize"
tags: ["oauth-mcp"]
---

# Authorize

`GET /oauth/authorize`

## Request

- Base URL: `https://api.meetadmiral.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.meetadmiral.com/oauth/authorize`
- Auth: none declared

Check the request, then send the person to Admiral to decide.

Everything that can be validated without knowing who the person is happens
here, because an error discovered now can be reported honestly. Once the
request is known good it is handed to the web app's consent screen as
opaque query parameters; the screen shows the client's name and the
accounts this person actually has, and posts back a decision.

A bad `redirect_uri` never redirects. That is the one error in OAuth that
must be shown rather than sent, since sending it is the attack.

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.dev/meetadmiral/apis/admiral-api.md) · [All operations](https://skmtc.dev/meetadmiral/apis/admiral-api/llms.txt) · [OpenAPI document](https://skmtc.dev/meetadmiral/apis/admiral-api/revisions/3cf1ee58ce50?raw)