---
title: "OAuth 2.1 authorization endpoint (browser redirect flow)"
method: GET
path: "/oauth/authorize"
tags: ["OAuth"]
---

# OAuth 2.1 authorization endpoint (browser redirect flow)

`GET /oauth/authorize`

## Request

- Base URL: `https://tre-app.com`
- URL: `https://tre-app.com/oauth/authorize`
- Auth: none required

Browser-only. Requires the authenticated web session (a Bearer token is not a person). Validates the CIMD client and exact redirect, then redirects to consent; after consent redirects to the client with `code`, `state` and `iss`. Answers 404 while `OAUTH_ENABLED` is off. No Tre bearer.

## Query parameters

- `response_type` 'code', required
- `client_id` string, uri, required
- `redirect_uri` string, uri, required
- `code_challenge` string, required
- `code_challenge_method` 'S256', required
- `state` string, required
- `scope` string
- `resource` string, uri

## Other responses

- `302`: Redirect to the client `redirect_uri` with `error` (`invalid_request`, `invalid_scope` or `invalid_target`), `error_description`, `state` and `iss` — only once the client and the redirect validated. The description is Tre’s own text in the character set RFC 6749 §4.1.2.1 allows: `<field> is missing` or `<field> is invalid`, and for `invalid_scope` the scopes Tre grants — never the value the client sent.
- `307`: Redirect to `/oauth/consent` once the request validates (setting the consent CSRF cookie), or to `/sign-in` when no web session is present.
- `400`: HTML error page when the client or redirect_uri cannot be validated (never redirects to an unvalidated URI).
- `404`: OAuth door is off (`OAUTH_ENABLED` unset or not `true`).
- `429`: HTML error page: the per-user authorize budget is spent; `Retry-After` names the wait. Never a client redirect.
- `500`: Unexpected failure — for example `AUTH_SECRET` unset when the validated request is sealed, or the session lookup failing. Never a client redirect.
- `503`: HTML error page: the rate limiter is unavailable; `Retry-After` names the wait. Never a client redirect.

---

[API](https://skmtc.dev/tre-app/apis/tre-rest-api.md) · [All operations](https://skmtc.dev/tre-app/apis/tre-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tre-app/apis/tre-rest-api/revisions/26a7187a05fc?raw)