---
title: "OAuth 2.0 authorization endpoint (authorization code + PKCE)"
method: GET
path: "/oauth/authorize"
tags: ["OAuth"]
---

# OAuth 2.0 authorization endpoint (authorization code + PKCE)

`GET /oauth/authorize`

## Request

- Base URL: `https://api.purplegrain.com`
- URL: `https://api.purplegrain.com/oauth/authorize`
- Auth: none declared

Starts the **authorization code** flow. The resource owner must be known to the server (e.g. via external
login and `OAUTH_RESOURCE_OWNER_LOGIN_URL`); this API does not use a Rails session cookie for that step.

Public clients must send PKCE: `code_challenge` and `code_challenge_method=S256`.

## Query parameters

- `client_id` string, required
- `redirect_uri` string, uri, required
- `response_type` 'code', required
- `scope` string
- `state` string
- `code_challenge` string
- `code_challenge_method` 'S256'
- `resource` string, uri

## Other responses

- `302`: Redirect to `redirect_uri` with `code` or OAuth error query parameters.
- `401`: Resource owner not authenticated.

---

[API](https://skmtc.dev/purplegrain/apis/purple-grain-api.md) · [All operations](https://skmtc.dev/purplegrain/apis/purple-grain-api/llms.txt) · [OpenAPI document](https://skmtc.dev/purplegrain/apis/purple-grain-api/revisions/29c5c990d66e?raw)