OAuth

OAUTH Authorize Context

What the connect card needs to render one in-flight consent ceremony.

Deliberately readable without a session. The card is framed by the customer's app, and it has to be able to ask "who is signed in?" before it knows the answer - viewer: null is what tells it to show sign-in. Reading the session when there is one is equally deliberate: a user already signed in to the dashboard must not be shown sign-in again, because signing in afresh cycles their session id and revokes the event-access keys attached to the old one. Using a partner's card would quietly sign them out.

The state key is the capability. It is HMAC-signed at authorize time and verified here before anything is looked up, so it cannot be guessed; an unsigned or tampered key is indistinguishable from an unknown one (404).

get/oauth/authorize/context

Request

  • Base URL: https://api.withone.ai
  • URL: https://api.withone.ai/oauth/authorize/context
  • Auth: one of:
    • none
    • Session (a scheme the document does not define)

Query parameters

state_keystring required

Response

The ceremony as the caller may see it

allowAllboolean required

True when the ceremony named no permission set (or the allow-all set), so the app offers the whole catalog. The card renders the offerable catalog as prospective in that case; without this it could not tell "everything" from an enumerated set that resolved to zero connectors, which activate would then refuse.

clientNamestring required

Display name of the app asking for access.

frameAncestorsstring required

The origins allowed to frame this card, as a frame-ancestors source list: the client's registered redirect-URI origins, or 'none' when it has none that parse.

Core cannot enforce this, and that is why it is here. A frame-ancestors policy governs the response it rides on, and the card document is served by the frontend, not by this server - a policy on the redirect that sends a browser there protects nothing. Whoever serves the card has to emit it, and this is where they get the answer: the ceremony names the client, the client's redirect origins are already its proven property, and both are known here.

loginHintstring nullable

Email the authorize URL suggested, for the card to pre-fill its sign-in field. Never a restriction: a user who types a different address signs in as that one.

logoUrlstring nullable

The app's logo, as its owner registered it. None when they registered none, which is the card's cue to fall back to whatever placeholder it draws.

reasonstring nullable

Why this app says it is asking, as its owner wrote it - see [ConsentReason]. None when they set none, which renders the screen exactly as it did before this existed.

Read from the client, not from the request, so it is the app's own words rather than the link-sender's.

Changes

No recorded changes to this operation across all 1 revision of this API.