Oauth authorize

Query parameters

• response_typestringRequired
  • code
• client_idstringRequired
  A registered client id, or the https URL of the client's metadata document
• redirect_uristringRequired
• code_challengestringRequired
  BASE64URL(SHA-256(code_verifier)), 43 characters (RFC 7636 section 4.2)
• code_challenge_methodstringRequired
  • S256
• resourcestringRequired
  The canonical URL of the MCP endpoint the grant is for (RFC 8707)
• scopestringOptional
  Space-separated (RFC 6749 section 3.3). mcp:console:read, optionally with mcp:console:write; mcp:supplier:read; or mcp:operator:read
• statestringOptional

Request body

This operation takes no request body.

Responses

• 302
  To the realm's consent screen (success), or to redirect_uri with error, error_description, state and iss (a refusal after the client and redirect_uri checks, when redirect_uri is a loopback IP literal…Show more

  To the realm's consent screen (success), or to redirect_uri with error, error_description, state and iss (a refusal after the client and redirect_uri checks, when redirect_uri is a loopback IP literal or the client is verified)
• 400
  invalid_request (reason REDIRECT_URI_MISMATCH) or invalid_client (reason CLIENT_UNKNOWN or CLIENT_METADATA_INVALID): the client or the redirect_uri could not be trusted, so the browser is not…Show more

  invalid_request (reason REDIRECT_URI_MISMATCH) or invalid_client (reason CLIENT_UNKNOWN or CLIENT_METADATA_INVALID): the client or the redirect_uri could not be trusted, so the browser is not redirected (RFC 6749 section 4.1.2.1). Also any later refusal (checks 3 to 6) for an unverified client whose redirect_uri is not a loopback IP literal, answered here instead of by redirect so the route is never an open redirector (RFC 9700 section 4.11.2)
  OAuthError
• 404NOT_FOUND — unknown or expired ref (unguessable refs, 15)ApiErrorResponse
• 405
  VALIDATION — the public edge serves GET, POST, PUT, PATCH and DELETE only; any other method is refused before the platform sees it (details.reason METHOD_NOT_ALLOWED, details.source edge).Show more

  VALIDATION — the public edge serves GET, POST, PUT, PATCH and DELETE only; any other method is refused before the platform sees it (details.reason METHOD_NOT_ALLOWED, details.source edge). Not retryable as sent.
  ApiErrorResponse
• 414
  VALIDATION — the request URI (path and query string) is longer than 8 KiB; the public edge refuses it before the platform sees it (details.reason URI_TOO_LONG, details.source edge).Show more

  VALIDATION — the request URI (path and query string) is longer than 8 KiB; the public edge refuses it before the platform sees it (details.reason URI_TOO_LONG, details.source edge). Not retryable as sent: send long input in the body of a POST.
  ApiErrorResponse
• 429
  Counted in fixed windows (default 15 min).Show more

  Counted in fixed windows (default 15 min). The signup, login, password and invite routes count every attempt per client address AND per subject (the email, the username + site, or the invite token). POST /v1/oauth/token is counted three ways, none of them on client_id alone, so knowing a client_id (which is not secret) never lets anyone spend its holder's budget: oauth-token counts every attempt per client address only; oauth-token-failure counts FAILED client authentications per client address and per (client address, client_id) pair; oauth-token-issued counts tokens issued per client_id only, and only a request whose secret, grant_type and scope all passed can spend it. details.reason says which limit tripped (CLIENT_RATE_LIMITED | SUBJECT_RATE_LIMITED) and details.action which count (signup | signup-verify | login | password-forgot | password-reset | invite-accept | oauth-token | oauth-token-failure | oauth-token-issued). Retry-After is whole seconds to the end of the window, and details.retryAfterMs mirrors it. The answer is the same whether or not the account or key exists, so the limit cannot be used to enumerate accounts, and nothing the caller sent is echoed. adds three counts per client address for the MCP grant routes: oauth-authorize (GET /v1/oauth/authorize, which may fetch a Client ID Metadata Document), oauth-register (POST /v1/oauth/register) and oauth-device (POST /v1/oauth/device_authorization), and one count per MCP grant, oauth-exchange-grant (the token exchange of POST /v1/oauth/token, counted per grant after the exchange client and the subject token verified, default 120 a minute), whose details.reason is EXCHANGE_RATE_LIMITED.
  ApiErrorResponse
• 500INTERNAL — a bug, and traceId is the support handle.ApiErrorResponse

Errors you should handle

Branch on code and honour retryable — never on the HTTP status alone.