---
title: "Authorize"
method: GET
path: "/oauth/v2/authorize"
tags: ["OAuth 2.0"]
---

# Authorize

`GET /oauth/v2/authorize`

## Request

- Base URL: `https://api.proof.com`
- URL: `https://api.proof.com/oauth/v2/authorize`
- Auth: none declared

Starts the [Authorization Code grant](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1) at the [authorization endpoint](https://datatracker.ietf.org/doc/html/rfc6749#section-3.1). Redirect the User's browser to this endpoint. The User signs in, then approves or denies the request. 

Proof then redirects to your `redirect_uri` per `response_mode`, carrying `code` and `state` on approval or `error` and `error_description` on denial. Every redirect also carries [`iss`](https://datatracker.ietf.org/doc/html/rfc9207#section-2), the issuer identifier of this authorization server. Compare it to `issuer` from `GET /.well-known/oauth-authorization-server` and reject the response when they differ. Exchange the `code` at `POST /oauth/v2/token` within 10 minutes. 

An unknown `client_id` or an unregistered `redirect_uri` sends the User to a Proof-hosted error page. Redirected [errors](https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1) use `invalid_scope`, `invalid_target`, `access_denied` and `invalid_request`.

## Query parameters

- `client_id` string, required
- `redirect_uri` string, required
- `response_type` 'code', required
- `scope` string, required
- `state` string
- `response_mode` 'query' | 'fragment' | 'form_post'
- `code_challenge` string
- `code_challenge_method` 'S256'

## Other responses

- `302`: successful

---

[API](https://skmtc.dev/proof/apis/oauth-2-0-api-specification.md) - [All operations](https://skmtc.dev/proof/apis/oauth-2-0-api-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/proof/apis/oauth-2-0-api-specification/revisions/7e769f9c96ed?raw)