---
title: "Desktop Authorize"
method: POST
path: "/v1/auth/desktop/authorize"
---

# Desktop Authorize

`POST /v1/auth/desktop/authorize`

## Request

- Base URL: `https://api.app.membase.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.app.membase.ai/v1/auth/desktop/authorize`
- Auth: none declared

Approval leg: an already signed-in browser session (cookie + CSRF, like every
other consumer mutation) binds a one-time code to its account/account. The SPA
performs the returned redirect itself, exactly like /v1/oauth/consent. The code
must never enter server logs (ENGINEERING.md §9.2) — it appears only in this
response body and the loopback redirect.

## Request body

- DesktopAuthorizeRequest
  - `redirect_uri` string, required
  - `code_challenge` string, required
  - `state` string

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error
- `default`: Error envelope (ADR 0027)

---

[API](https://skmtc.dev/membase/apis/membase-hosted-api.md) · [All operations](https://skmtc.dev/membase/apis/membase-hosted-api/llms.txt) · [OpenAPI document](https://skmtc.dev/membase/apis/membase-hosted-api/revisions/e0ac58cdb320?raw)