OAuth

Authorization endpoint

Authorization code + PKCE S256. Query: response_type=code, client_id, redirect_uri (exact match to a registered URI), code_challenge, code_challenge_method=S256, optional state, optional scope, optional resource (stored, not matched against /mcp). Unknown client is 400 invalid_client. Bad redirect is 400 invalid_redirect. Neither redirects. A valid request redirects (307) to the browser connect page. The code is issued only after consent.

get/oauth/authorize

Request

  • Base URL: https://xn--s7y.xn--3ds443g
  • URL: https://xn--s7y.xn--3ds443g/oauth/authorize
  • Auth: none required

Query parameters

response_type'code' required
client_idstring required
redirect_uristring required
code_challengestring required
code_challenge_method'S256' required
statestring
scopestring

Space-separated issuable scopes. Omit for links:read only.

resourcestring

Optional. Stored on the transaction. Not validated against /mcp.

Changes

No recorded changes to this operation across all 1 revision of this API.