---
title: "Mint an MCP authorization code"
method: POST
path: "/auth/mcp/authorize"
tags: ["auth"]
---

# Mint an MCP authorization code

`POST /auth/mcp/authorize`

## Request

- Base URL: `https://api.thebridge.dev` (the document declares no server; this is the origin it was published from)
- URL: `https://api.thebridge.dev/auth/mcp/authorize`
- Auth: none declared

Creates a 60-second single-use authorization code bound to a registered MCP client, its redirect_uri, and a PKCE S256 challenge. Authenticated via the user session (Authorization: Bearer).

## Response `200`

Authorization code created

## Other responses

- `400`: Validation failure (unknown client, bad redirect_uri, bad challenge)
- `401`: Missing/invalid user JWT
- `403`: appId not owned by user

---

[API](https://skmtc.dev/thebridge/apis/bridge-api.md) · [All operations](https://skmtc.dev/thebridge/apis/bridge-api/llms.txt) · [OpenAPI document](https://skmtc.dev/thebridge/apis/bridge-api/revisions/290fffcb3d80?raw)