API referenceIdentity and accessOAuth 2.1
Start an authorization code flow
Renders the sign-in form, or redirects straight back with a code when the browser already holds a valid IdP session cookie. PKCE is mandatory. Authorization codes live 90 seconds.
Query Parameters
response_type*"code"
Value in
- "code"
client_id*string
redirect_uri*string
code_challenge*string
code_challenge_method*"S256"
Value in
- "S256"
scope?string
Space-separated. openid adds an id_token, mcp unlocks the MCP server.
state?string
resource?string
RFC 8707 audience. Defaults to the MCP endpoint.
Response Body
text/html
application/json
curl -X GET "https://example.com/oauth/authorize?response_type=code&client_id=string&redirect_uri=string&code_challenge=string&code_challenge_method=S256""string"