---
title: "Authorization endpoint"
method: GET
path: "/oauth/authorize"
tags: ["OAuth"]
---

# Authorization endpoint

`GET /oauth/authorize`

## Request

- Base URL: `https://xn--s7y.xn--3ds443g`
- URL: `https://xn--s7y.xn--3ds443g/oauth/authorize`
- Auth: none required

Authorization code + PKCE S256. Query: `response_type=code`, `client_id`, `redirect_uri` (exact match to a registered URI), `code_challenge`, `code_challenge_method=S256`, optional `state`, optional `scope`, optional `resource` (stored, not matched against `/mcp`). Unknown client is 400 `invalid_client`. Bad redirect is 400 `invalid_redirect`. Neither redirects. A valid request redirects (307) to the browser connect page. The code is issued only after consent.

## Query parameters

- `response_type` 'code', required
- `client_id` string, required
- `redirect_uri` string, required
- `code_challenge` string, required
- `code_challenge_method` 'S256', required
- `state` string
- `scope` string
- `resource` string

## Other responses

- `302`: Redirect to redirect_uri with an OAuth error
- `307`: Browser redirect to the connect page (`/{locale}/oauth/connect?txn=`)
- `400`: invalid_client or invalid_redirect (JSON, no Location)

---

[API](https://skmtc.dev/xn--s7y/apis/agent-api.md) · [All operations](https://skmtc.dev/xn--s7y/apis/agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/xn--s7y/apis/agent-api/revisions/d902f68518e9?raw)