---
title: "Authorize"
method: POST
path: "/v1/idp/oauth/authorize"
tags: ["Idp"]
---

# Authorize

`POST /v1/idp/oauth/authorize`

## Request

- Base URL: `https://api.stytch.com`
- URL: `https://api.stytch.com/v1/idp/oauth/authorize`
- Auth: HTTP basic

Completes a request for authorization of a Connected App to access a User's account.

Call this endpoint using the query parameters from an OAuth Authorization request, after previously validating those parameters using the
[Preflight Check](https://stytch.com/docs/api/connected-apps-oauth-authorize-start) API.
Note that this endpoint takes in a few additional parameters the preflight check does not- `state`, `nonce`, and `code_challenge`.

If the authorization was successful, the `redirect_uri` will contain a valid `authorization_code` embedded as a query parameter.
If the authorization was unsuccessful, the `redirect_uri` will contain an OAuth2.1 `error_code`.
In both cases, redirect the user to the location for the response to be consumed by the Connected App. 

Exactly one of the following must be provided to identify the user granting authorization:
- `user_id`
- `session_token`
- `session_jwt`

If a `session_token` or `session_jwt` is passed, the OAuth Authorization will be linked to the user's session for tracking purposes.
One of these fields must be used if the Connected App intends to complete the [Exchange Access Token](https://stytch.com/docs/api/connected-app-access-token-exchange) flow.

## Request body

- ApiIdpV1IdpOauthAuthorizeRequest: Request type
  - `consent_granted` boolean, required: Indicates whether the user granted the requested scopes.
  - `scopes` string[], required: An array of scopes requested by the client.
  - `client_id` string, required: The ID of the Connected App client.
  - `redirect_uri` string, required: The callback URI used to redirect the user after authentication. This is the same URI provided at the start of the OAuth flow. This field is required when using the `authorization_code` grant.
  - `response_type` string, required: The OAuth 2.0 response type. For authorization code flows this value is `code`.
  - `user_id` string: The unique ID of a specific User. You may use an `external_id` here if one is set for the user.
  - `session_token` string: The `session_token` associated with a User's existing Session.
  - `session_jwt` string: The `session_jwt` associated with a User's existing Session.
  - `prompt` string: Space separated list that specifies how the Authorization Server should prompt the user for reauthentication and consent. Only `consent` is supported today.
  - `state` string: An opaque value used to maintain state between the request and callback.
  - `nonce` string: A string used to associate a client session with an ID token to mitigate replay attacks.
  - `code_challenge` string: A base64url encoded challenge derived from the code verifier for PKCE flows.
  - `resources` string[]

## Response `200`

Successful response

- ApiIdpV1IdpOauthAuthorizeResponse
  - `request_id` string, required: Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.
  - `redirect_uri` string, required: The callback URI used to redirect the user after authentication. This is the same URI provided at the start of the OAuth flow. This field is required when using the `authorization_code` grant.
  - `status_code` integer, required
  - `authorization_code` string: A one-time use code that can be exchanged for tokens.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `429`: Too Many Requests
- `500`: Internal server error

## Changes

- **2026-03-07** `110f26a94e5b`: 1 info
  - endpoint added
- **2026-03-06** `9cab20b8eca7`: 1 breaking
  - api path removed without deprecation
- **2025-11-03** `b2acbf387799`: 1 info
  - the request property `resources` became optional
- **2025-10-23** `4a2e3c0c0c05`: 1 breaking
  - added the new required request property `resources`
- **2025-09-17** `8270cf3a3d4c`: 3 info
  - added the media type `application/json` for the response with the status `401`
  - added the media type `application/json` for the response with the status `500`
  - added the non-success response with the status `429`

[Operation history](https://skmtc.dev/stytch/apis/stytch-api/changes/v1/idp/oauth/authorize/post.md)

---

[API](https://skmtc.dev/stytch/apis/stytch-api.md) - [All operations](https://skmtc.dev/stytch/apis/stytch-api/llms.txt) - [OpenAPI document](https://skmtc.dev/stytch/apis/stytch-api/revisions/6d1ff7474803?raw)