---
title: "Begin authorization"
method: GET
path: "/oauth/authorize"
tags: ["OAuth"]
---

# Begin authorization

`GET /oauth/authorize`

## Request

- Base URL: `https://scanduro.com`
- URL: `https://scanduro.com/oauth/authorize`
- Auth: HTTP bearer

Validates the request, stores it under an opaque id, and redirects the browser to the
first-party consent screen at `/oauth/consent/{id}`.

Two failure classes, deliberately answered differently. If the `client_id` is unknown or the
`redirect_uri` is not an exact match for a registered value, the browser is shown an error
**page** — never a redirect. Redirecting to an unvalidated URI is how an authorization server
becomes an open redirector. Once the redirect target is validated, everything else
(`response_type`, PKCE) is returned to the client as an OAuth error on that URI.

`redirect_uri` is compared as an exact string. Prefix matching is how
`https://app.example.com/cb` becomes `https://app.example.com/cb.evil`.

## Query parameters

- `response_type` 'code', required
- `client_id` string, required
- `redirect_uri` string, uri, required
- `code_challenge` string, required
- `code_challenge_method` 'S256', required
- `scope` string
- `state` string
- `resource` string, uri

## Other responses

- `302`: To the consent screen, or back to the client with an OAuth error.
- `400`: An HTML error page. Reached only when the client or redirect URI could not be validated, in which case redirecting would be unsafe.

---

[API](https://skmtc.dev/scanduro/apis/scanduro-public-api.md) · [All operations](https://skmtc.dev/scanduro/apis/scanduro-public-api/llms.txt) · [OpenAPI document](https://skmtc.dev/scanduro/apis/scanduro-public-api/revisions/cdb36d96cad7?raw)