---
title: "Start OAuth sign-in"
method: GET
path: "/api/oauth/authorize"
tags: ["Agent Discovery"]
---

# Start OAuth sign-in

`GET /api/oauth/authorize`

## Request

- Base URL: `https://xquik.com`
- URL: `https://xquik.com/api/oauth/authorize`
- Auth: none required

Open this URL in the user's browser to start OAuth 2.1 sign-in with PKCE. The user signs in & approves access. Xquik then sends a code to your redirect_uri.

## Query parameters

- `response_type` 'code', required
- `client_id` string, required
- `redirect_uri` string
- `code_challenge` string, required
- `code_challenge_method` 'S256', required
- `scope` string
- `resource` string
- `state` string
- `locale` 'en' | 'es' | 'ja' | 'ko' | 'tr' | 'zh'

## Response `200`

The sign-in or consent page. A missing or unknown client_id, or a redirect_uri the client didn't register, shows an error page instead, since Xquik can't redirect.

## Other responses

- `302`: Redirects to redirect_uri with error, error_description & state when the request is invalid, such as a missing code_challenge.
- `403`: The signed-in account must confirm its email first.
- `413`: The query string exceeds 16,384 characters.
- `429`: Too many sign-in requests. Retry after Retry-After.
- `500`: Unexpected error.
- `4XX`: Client error. The error code says what to fix.
- `default`: Unexpected error.

## Changes

- **2026-11-02** `20d4bcaa8f4e`: 1 info
  - removed the non-success response with the status `500`
- **2026-11-02** `48f2012c62b3`: 1 info
  - added the non-success response with the status `500`
- **2026-11-01** `1863d7ef8b4d`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/xquik-dev/apis/xquik-api/changes/api/oauth/authorize/get.md)

---

[API](https://skmtc.dev/xquik-dev/apis/xquik-api.md) - [All operations](https://skmtc.dev/xquik-dev/apis/xquik-api/llms.txt) - [OpenAPI document](https://skmtc.dev/xquik-dev/apis/xquik-api/revisions/db6708e077dc?raw)