---
title: "OAuth 2.1 Authorization endpoint"
method: GET
path: "/oauth/authorize"
tags: ["oauth-server"]
---

# OAuth 2.1 Authorization endpoint

`GET /oauth/authorize`

Initiates the OAuth authorization code flow. Redirects users to login and authorize the requesting application. Only available when OAuth server is enabled (set `GOTRUE_OAUTH_SERVER_ENABLED=true` for self-hosted or enable in Supabase Dashboard).

## Query parameters

- `response_type` 'code', required
- `client_id` string, required
- `redirect_uri` string, uri, required
- `scope` string
- `state` string
- `code_challenge` string, required
- `code_challenge_method` 'S256', required

## Other responses

- `302` — Redirect to login or authorization page
- `400` — HTTP Bad Request response. Can occur if the passed in JSON cannot be unmarshalled properly or when CAPTCHA verification was not successful. In certain cases can also occur when features are disabled on the server (e.g. sign ups). It may also mean that the operation failed due to some constraint not being met (such a user already exists for example).

## Changes

- **2025-09-22** `f782805361ed` — 1 info
  - endpoint added
- **2023-02-01** `144a34ca6d74` — 1 breaking
  - api path removed without deprecation

[Change history](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/changes/oauth/authorize/get.md)

---

[API](https://skmtc.dev/supabase/apis/supabase-auth-rest-api.md) · [All operations](https://skmtc.dev/supabase/apis/supabase-auth-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/supabase/supabase-auth-rest-api/revisions/2e2a74a7459f/schema)