---
title: "Authorize Complete"
method: POST
path: "/oauth/authorize/complete"
tags: ["oauth"]
---

# Authorize Complete

`POST /oauth/authorize/complete`

## Request

- Base URL: `https://api.nicheangle.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.nicheangle.com/oauth/authorize/complete`
- Auth: none declared

Internal endpoint — called by the web consent page after the
user's decision lands. Mints the auth code on approval, returns the
redirect URL the web side sends the user to.

Auth: requires a valid Supabase JWT in the Authorization header.
The JWT's `sub` claim becomes the authorized user — body cannot
override (confused-deputy guard).

## Request body

- AuthorizeCompleteRequest: Payload posted by the web consent page after the user clicks Authorize / Deny. The authenticated Supabase user (resolved server-side from the Authorization: Bearer header) is the one we issue the code for — the body's user_id field is IGNORED if it disagrees with the JWT, to prevent confused-deputy attacks.
  - `client_id` string, required
  - `redirect_uri` string, required
  - `scope` string
  - `state` string
  - `code_challenge` string, required
  - `code_challenge_method` string
  - `approved` boolean, required

## Response `200`

Successful Response

- unknown

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/nicheangle/apis/signal-api.md) · [All operations](https://skmtc.dev/nicheangle/apis/signal-api/llms.txt) · [OpenAPI document](https://skmtc.dev/nicheangle/apis/signal-api/revisions/ed8b47ff5891?raw)