---
title: "OAuth 2.1 authorization endpoint (PKCE)"
method: GET
path: "/oauth2/authorize"
tags: ["agent-auth"]
---

# OAuth 2.1 authorization endpoint (PKCE)

`GET /oauth2/authorize`

## Request

- Base URL: `https://www.supersetapp.com`
- URL: `https://www.supersetapp.com/oauth2/authorize`
- Auth: none required

The consent screen an MCP connector sends a person to. Standard authorization-code flow with S256 PKCE; parameters and the supported grants are published in `/.well-known/oauth-authorization-server`.

## Query parameters

- `response_type` string, required
- `client_id` string, required
- `redirect_uri` string, uri, required
- `code_challenge` string, required
- `code_challenge_method` string, required
- `scope` string
- `state` string
- `resource` string, uri

## Response `200`

The consent screen (HTML).

## Other responses

- `302`: Back to `redirect_uri` with an `error`, or to the sign-in page. The `code` comes from the consent form's own POST, not from this GET.
- `400`: Unknown `client_id` or unregistered `redirect_uri` (HTML).
- `429`: Rate limit exceeded (HTML).

---

[API](https://skmtc.dev/supersetapp/apis/superset-api.md) - [All operations](https://skmtc.dev/supersetapp/apis/superset-api/llms.txt) - [OpenAPI document](https://skmtc.dev/supersetapp/apis/superset-api/revisions/80be14a3d402?raw)