OAuth

OAuth 2.0 authorization endpoint (authorization code + PKCE)

Starts the authorization code flow. The resource owner must be known to the server (e.g. via external login and OAUTH_RESOURCE_OWNER_LOGIN_URL); this API does not use a Rails session cookie for that step.

Public clients must send PKCE: code_challenge and code_challenge_method=S256.

get/oauth/authorize

Request

  • Base URL: https://api.purplegrain.com
  • URL: https://api.purplegrain.com/oauth/authorize
  • Auth: none declared

Query parameters

client_idstring required
redirect_uristring uri required
response_type'code' required
scopestring
statestring
code_challengestring

PKCE code challenge (S256).

code_challenge_method'S256'
resourcestring uri

Resource indicator (RFC 8707); must be the exact MCP resource URI advertised by discovery.

Changes

No recorded changes to this operation across all 2 revisions of this API.