---
title: "Start an OAuth flow in LINK mode (attach to the current principal)"
method: POST
path: "/agent/v1/control-plane/oauth/{provider}/link"
tags: ["ControlPlane"]
---

# Start an OAuth flow in LINK mode (attach to the current principal)

`POST /agent/v1/control-plane/oauth/{provider}/link`

## Request

- Base URL: `https://api.run402.com`
- URL: `https://api.run402.com/agent/v1/control-plane/oauth/{provider}/link`
- Auth: none declared

Authenticated + step-up (authenticator.register). Returns the provider authorize URL for a flow whose callback attaches the resulting Google/GitHub identity to the CURRENT principal — including an owner-capable one (the explicit confirmed link that completes needs_confirmation). If the identity is already actively bound to a DIFFERENT principal, the callback lands on the console's merge guidance (#oauth_link_conflict) instead of logging the browser into that principal.

## Path parameters

- `provider` 'google' | 'github', required

## Response `200`

Provider authorize URL { auth_url }

- object

## Other responses

- `403`: STEP_UP_REQUIRED
- `503`: Provider OAuth not configured

---

[API](https://skmtc.dev/run402/apis/run402-api.md) · [All operations](https://skmtc.dev/run402/apis/run402-api/llms.txt) · [OpenAPI document](https://skmtc.dev/run402/apis/run402-api/revisions/893607557f50?raw)