Idp

Initiates a request for authorization of a Connected App to access a User's account.

Call this endpoint using the query parameters from an OAuth Authorization request. This endpoint validates various fields (scope, client_id, redirect_uri, prompt, etc...) are correct and returns relevant information for rendering an OAuth Consent Screen.

This endpoint returns:

  • A public representation of the Connected App requesting authorization
  • Whether explicit user consent must be granted before proceeding with the authorization
  • A list of scopes the user has the ability to grant the Connected App

Use this response to prompt the user for consent (if necessary) before calling the Submit OAuth Authorization endpoint.

Exactly one of the following must be provided to identify the user granting authorization:

  • user_id
  • session_token
  • session_jwt

If a session_token or session_jwt is passed, the OAuth Authorization will be linked to the user's session for tracking purposes. One of these fields must be used if the Connected App intends to complete the Exchange Access Token flow.

post/v1/idp/oauth/authorize/start

Request

  • Base URL
    https://api.stytch.com
  • Auth
    HTTP basic

Request body

client_idstring required

The ID of the Connected App client.

redirect_uristring required

The callback URI used to redirect the user after authentication. This is the same URI provided at the start of the OAuth flow. This field is required when using the authorization_code grant.

response_typestring required

The OAuth 2.0 response type. For authorization code flows this value is code.

scopesstring[] required

An array of scopes requested by the client.

user_idstring

The unique ID of a specific User. You may use an external_id here if one is set for the user.

session_tokenstring

The session_token associated with a User's existing Session.

session_jwtstring

The session_jwt associated with a User's existing Session.

promptstring

Space separated list that specifies how the Authorization Server should prompt the user for reauthentication and consent. Only consent is supported today.

Response

Successful response

request_idstring required

Globally unique UUID that is returned with every API call. This value is important to log for debugging purposes; we may ask for this value to help identify a specific API call when helping you debug an issue.

user_idstring required

The unique ID of the affected User.

consent_requiredboolean required

Whether the user must provide explicit consent for the authorization request.

status_codeinteger required

Changes