---
title: "App MCP authorization request"
method: GET
path: "/_run402/oauth/authorize"
tags: ["Stable Hosts"]
---

# App MCP authorization request

`GET /_run402/oauth/authorize`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/_run402/oauth/authorize`
- Auth: none required

OAuth 2.1 authorization endpoint (PKCE S256 only). `scope` is `tools`, optionally with `openid`, `email`, `profile` (and `offline_access`); `nonce` (1-255 characters) is echoed in the id_token. A loopback `http` redirect_uri matches its registration on any port (RFC 8252 §7.3). A signed-out user is sent to the release's `site.sign_in_path` (else the hosted `/auth/sign-in`) with `returnTo`, and back; a signed-in user sees a consent page. An unknown client or unregistered redirect_uri gets an error page and is never redirected.

## Response `200`

Consent page (HTML).

## Other responses

- `303`: To hosted sign-in, or back to the client with an error and `iss`.
- `400`: Error page.

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)