---
title: "Authorization endpoint (authorization code + PKCE)"
method: GET
path: "/api/oauth/authorize"
tags: ["oauth"]
---

# Authorization endpoint (authorization code + PKCE)

`GET /api/oauth/authorize`

## Request

- Base URL: `https://app.presify.io`
- URL: `https://app.presify.io/api/oauth/authorize`
- Auth: none declared

Browser entry point of the authorization-code flow. Validates the request, then sends the person to Microsoft sign-in (if needed) and the Presify consent page; on approval the browser is redirected to redirect_uri with `code` and `state`. PKCE with S256 is required. A client_id that is an https URL names a Client ID Metadata Document: Presify fetches it (https only, public addresses only, no redirects, at most 5 KB, cached per its Cache-Control), and a document it cannot fetch or validate is treated as an unknown client. An unknown client_id, an unregistered redirect_uri, or any error for a redirect_uri Presify has not verified (anything other than a known AI assistant callback or a loopback address) renders a local error page and never redirects (open-redirect guard); for a verified or loopback redirect_uri, errors redirect back to the client with `error` and `error_description`.

## Query parameters

- `response_type` 'code', required
- `client_id` union, required
  - string, uuid: Client registered through dynamic client registration (RFC 7591).
  - string, uri: Client ID Metadata Document URL: https, no port, query or fragment, served from a public host.
- `redirect_uri` string, uri, required
- `code_challenge` string, required
- `code_challenge_method` 'S256', required
- `state` string
- `scope` string
- `resource` string, uri

## Other responses

- `302`: Redirect to sign-in / consent, or back to redirect_uri with `code` + `state`.
- `307`: Error redirect back to a verified or loopback redirect_uri with `error`, `error_description` and `state`.
- `400`: Unknown client, unregistered redirect_uri, or an error for an unverified redirect_uri: a local HTML error page (no redirect).

---

[API](https://skmtc.dev/presify/apis/presify-public-api.md) · [All operations](https://skmtc.dev/presify/apis/presify-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/presify/apis/presify-public-api/revisions/5e3fe7801ad1?raw)