---
title: "OAuth 2.1 authorization endpoint (renders the consent screen)"
method: GET
path: "/oauth/authorize"
tags: ["OAuth"]
---

# OAuth 2.1 authorization endpoint (renders the consent screen)

`GET /oauth/authorize`

## Request

- Base URL: `https://api.mnemom.ai/v1`
- URL: `https://api.mnemom.ai/v1/oauth/authorize`
- Auth: none required

Begins the authorization-code + PKCE flow. Identity is delegated to Supabase GoTrue via the Mnemom session cookie; an unauthenticated user is redirected to the hosted login and returns here. With a valid session, renders the server-side consent screen listing the requested scopes in product language. PKCE S256 is mandatory; redirect_uri must exactly match one registered for the client.

## Query parameters

- `response_type` 'code', required
- `client_id` string, required
- `redirect_uri` string, uri, required
- `scope` string, required
- `state` string
- `code_challenge` string, required
- `code_challenge_method` 'S256', required

## Response `200`

Consent screen (HTML).

## Other responses

- `302`: Redirect to the hosted login (unauthenticated) or back to the client's redirect_uri with an error per RFC 6749 §4.1.2.1.
- `400`: Unknown client_id or unregistered redirect_uri — rendered as an HTML error page; never redirected (open-redirect guard).
- `429`: Rate-limit exceeded. The global per-IP limiter (100 requests/minute, applied to every `/v1/*` route) rejected this request. Back off until the window resets — `Retry-After` carries the cooldown in seconds and `X-RateLimit-Reset` the absolute reset time.
- `500`: Server error — request was well-formed but the server failed to fulfill it. Typically a downstream dependency (DB / RPC / external API) returned an unexpected error.

---

[API](https://skmtc.dev/mnemom/apis/mnemom-api.md) · [All operations](https://skmtc.dev/mnemom/apis/mnemom-api/llms.txt) · [OpenAPI document](https://skmtc.dev/mnemom/apis/mnemom-api/revisions/274b7a6ea182?raw)