---
title: "Approve or deny OAuth authorization"
method: POST
path: "/oauth/authorizations/{authorization_id}/consent"
tags: ["oauth-server"]
---

# Approve or deny OAuth authorization

`POST /oauth/authorizations/{authorization_id}/consent`

User approves or denies authorization to the OAuth client. Only available when OAuth server is enabled (set `GOTRUE_OAUTH_SERVER_ENABLED=true` for self-hosted or enable in Supabase Dashboard).

## Request body

- object
  - `action` 'approve' | 'deny', required — Whether to approve or deny the authorization

## Response `200`

Authorization consent processed

- object
  - `redirect_url` string, uri

## Other responses

- `400` — HTTP Bad Request response. Can occur if the passed in JSON cannot be unmarshalled properly or when CAPTCHA verification was not successful. In certain cases can also occur when features are disabled on the server (e.g. sign ups). It may also mean that the operation failed due to some constraint not being met (such a user already exists for example).
- `401` — HTTP Unauthorized response.

## Changes

- **2025-09-22** `f782805361ed` — 1 info
  - endpoint added
- **2023-02-01** `144a34ca6d74` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/changes/oauth/authorizations/:authorization_id/consent/post.md)

---

[API](https://skmtc.dev/supabase/apis/supabase-auth-rest-api.md) · [All operations](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/supabase/supabase-auth-rest-api/revisions/2e2a74a7459f/schema)