---
title: "Start an authorization (RFC 6749 §4.1, PKCE S256 required)"
method: GET
path: "/oauth/authorize"
tags: ["OAuth / MCP"]
---

# Start an authorization (RFC 6749 §4.1, PKCE S256 required)

`GET /oauth/authorize`

## Request

- Base URL: `https://whatareyoudo.ing/api/v1`
- URL: `https://whatareyoudo.ing/api/v1/oauth/authorize`
- Auth: none declared

Checks the request and redirects the browser to the app's consent screen (`/oauth/authorize` on the site). An error the client can be told about is redirected back to its redirect URI with `error` and `iss` (RFC 9207); an unknown client or an unregistered redirect URI is answered here with 400 and never redirected.

## Query parameters

- `response_type` 'code', required
- `client_id` string, required
- `redirect_uri` string
- `code_challenge` string, required
- `code_challenge_method` 'S256', required
- `state` string
- `scope` string
- `resource` string

## Other responses

- `302`: To the consent screen, or back to the client with an error
- `400`: Unknown client or unregistered redirect URI

---

[API](https://skmtc.dev/whatareyoudo/apis/whatcha-api.md) · [All operations](https://skmtc.dev/whatareyoudo/apis/whatcha-api/llms.txt) · [OpenAPI document](https://skmtc.dev/whatareyoudo/apis/whatcha-api/revisions/48dd8a54abea?raw)