---
title: "Authorization endpoint (RFC 6749 §3.1)"
method: GET
path: "/oauth/authorize"
tags: ["OAuth"]
---

# Authorization endpoint (RFC 6749 §3.1)

`GET /oauth/authorize`

## Request

- Base URL: `https://passport.me`
- URL: `https://passport.me/oauth/authorize`
- Auth: none required

Browser-facing authorization endpoint. Presents a consent UI to the logged-in Passport user. Agents should open this URL in the user's browser rather than fetching it server-side. Supports PKCE (S256 required).

## Query parameters

- `response_type` 'code', required
- `client_id` string, required
- `redirect_uri` string, uri, required
- `scope` 'passport.mcp', required
- `state` string, required
- `code_challenge` string, required
- `code_challenge_method` 'S256', required

## Response `200`

Consent HTML page (when the user has not yet decided).

## Other responses

- `302`: Redirect back to `redirect_uri` with `code` + `state` on approval, or `error` on denial.

---

[API](https://skmtc.dev/passport-me/apis/passport-me-api.md) · [All operations](https://skmtc.dev/passport-me/apis/passport-me-api/llms.txt) · [OpenAPI document](https://skmtc.dev/passport-me/apis/passport-me-api/revisions/c0081754a2dc?raw)