---
title: "Create or deny an MCP OAuth authorization response"
method: POST
path: "/mcp/oauth/authorize"
tags: ["Auth"]
---

# Create or deny an MCP OAuth authorization response

`POST /mcp/oauth/authorize`

## Request

- Base URL: `https://app.openpo.st/api/v1`
- URL: `https://app.openpo.st/api/v1/mcp/oauth/authorize`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `openpost_session`

## Request body

- CreateMCPOAuthAuthorizationInputBody
  - `$schema` string, uri: A URL to the JSON Schema for this object.
  - `approved` boolean, required: Whether the user approved the MCP OAuth request
  - `client_id` string, required: OAuth client ID or client metadata URL
  - `code_challenge` string: PKCE S256 code challenge. Required when approved is true.
  - `code_challenge_method` string: PKCE method. Must be S256 when approved is true.
  - `redirect_uri` string, required: OAuth redirect URI
  - `resource` string: MCP protected resource URL
  - `response_type` string, required: OAuth response type. Must be code.
  - `scope` string: Space-separated MCP scopes: mcp:read and mcp:full. Requesting both returns both scopes while enforcing mcp:full. Defaults to mcp:full.
  - `state` string: Opaque client state to echo to the redirect URI
  - `workspace_id` string: Optional workspace ID the resulting MCP token is limited to

## Response `200`

OK

- CreateMCPOAuthAuthorizationOutputBody
  - `$schema` string, uri: A URL to the JSON Schema for this object.
  - `redirect_url` string, required: URL the browser should redirect to after authorization

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `422`: Unprocessable Entity
- `500`: Internal Server Error

---

[API](https://skmtc.dev/openpo/apis/openpost-api.md) · [All operations](https://skmtc.dev/openpo/apis/openpost-api/llms.txt) · [OpenAPI document](https://skmtc.dev/openpo/apis/openpost-api/revisions/67d3964458a7?raw)