OAuth

OAuth 2.1 authorization endpoint (browser redirect flow)

Browser-only. Requires the authenticated web session (a Bearer token is not a person). Validates the CIMD client and exact redirect, then redirects to consent; after consent redirects to the client with code, state and iss. Answers 404 while OAUTH_ENABLED is off. No Tre bearer.

get/oauth/authorize

Request

  • Base URL: https://tre-app.com
  • URL: https://tre-app.com/oauth/authorize
  • Auth: none required

Query parameters

response_type'code' required

Always code.

client_idstring uri required

HTTPS Client ID Metadata Document URL.

redirect_uristring uri required

HTTPS redirect URI; must equal one the client metadata document lists.

code_challengestring required

PKCE code challenge (RFC 7636).

code_challenge_method'S256' required

Always S256: PKCE is mandatory.

statestring required

Returned to the client untouched.

scopestring

RFC 6749 §3.3 space-delimited list of scopes. Naming exactly one of read, write, admin asks for that one; naming several of them — the MCP reference client sends every scopes_supported value — or none asks for the default, write. Unknown names beside a known one are ignored; naming only unknown ones redirects with invalid_scope. The consent page shows the scope asked for, and the token response names the one granted.

resourcestring uri

RFC 8707 resource indicator, optional: a request without one is for this deployment’s MCP URL, the one resource it serves. When sent, it must be that URL (https://<host>/api/mcp, exactly as the protected-resource metadata publishes it); any other redirects with invalid_target.

Changes

No recorded changes to this operation across all 1 revision of this API.