OAuth

Headless authorization grant

Mints an authorization code on behalf of an already-authenticated user. Because sessions are disabled on the API, the interactive GET /oauth/authorize consent UI cannot establish a resource owner; the frontend authenticates the user, shows the consent screen, and POSTs the original authorize params here with the user's Authorization: Bearer token. PKCE is enforced exactly as in the standard flow. Returns the redirect URI (carrying code + state) for the browser to follow back to the client, which then exchanges the code at POST /oauth/token.

post/oauth/authorize/grant

Request

  • Base URL: https://api.purplegrain.com
  • URL: https://api.purplegrain.com/oauth/authorize/grant
  • Auth: HTTP bearer

Request body

client_idstring required
response_type'code' required
redirect_uristring uri required
scopestring
statestring
code_challengestring required

PKCE code challenge (S256).

code_challenge_method'S256' required
noncestring
resourcestring uri

The exact MCP resource URI advertised by discovery. Omission uses that resource for existing clients.

Response

Authorization code issued.

redirect_uristring uri

Changes

No recorded changes to this operation across all 1 revision of this API.