Desktop Authorize

Approval leg: an already signed-in browser session (cookie + CSRF, like every other consumer mutation) binds a one-time code to its account/account. The SPA performs the returned redirect itself, exactly like /v1/oauth/consent. The code must never enter server logs (ENGINEERING.md §9.2) — it appears only in this response body and the loopback redirect.

post/v1/auth/desktop/authorize

Request

  • Base URL: https://api.app.membase.ai (the document declares no server; this is the origin it was published from)
  • URL: https://api.app.membase.ai/v1/auth/desktop/authorize
  • Auth: none declared

Request body

redirect_uristring required
code_challengestring required
statestring

Response

Successful Response

object required

Changes

No recorded changes to this operation across all 1 revision of this API.