Authorize

The authorization endpoint (browser). A valid request is a 302 to the web app's consent screen (`/oauth/consent?request=<signed request>`, 10 minutes); an unknown client or redirect URI is a 302 to the consent screen with `error`; any other problem is a 302 back to the client's redirect URI with `error` and `state` (RFC 6749 §4.1.2.1).

API key access

This route has its own authentication (or none); an API key is not used here.

GET/api/v1/oauth/authorize

Query Parameters

response_typestring

code

client_idstring

redirect_uri?string

One of the registered redirect URIs (optional when exactly one is registered).

code_challengestring

PKCE challenge (43-128 characters).

code_challenge_methodstring

S256

state?string

scope?string

Space-separated API-key scopes (leads:* allowed); default: every scope but admin.

resource?string

RFC 8707: the MCP endpoint (<origin>/api/v1/mcp).

Response Body

curl -X GET "http://localhost:8000/api/v1/oauth/authorize?response_type=string&client_id=string&redirect_uri=string&code_challenge=string&code_challenge_method=string&state=string&scope=string&resource=string"

curl -X GET "http://localhost:8000/api/v1/oauth/authorize?response_type=string&client_id=string&redirect_uri=string&code_challenge=string&code_challenge_method=string&state=string&scope=string&resource=string"

Empty

Query Parameters

Response Body

302

404