Start a sign-in

The authorization code flow with PKCE. Send the browser here to sign a user in.

GET /oauth/authorize

The start of the authorization code flow with PKCE. Send the browser here: navigate to it, do not fetch it. The user signs in on the client’s login page and comes back to redirect_uri with a code.

Authorization

None. This route is public: nobody holds a token yet. PKCE is required for every client, public or confidential.

Query parameters

Name	Type	Required	Description
`response_type`	string	Yes	`code`, the only one.
`client_id`	string	Yes	A client of the org whose host you called.
`redirect_uri`	URL	Yes	Must exactly match one of the client’s registered redirect URIs.
`code_challenge`	string	Yes	The S256 challenge: 43 base64url characters. Sending the verifier here instead is refused. See PKCE.
`code_challenge_method`	string	No	`S256`. Absent is read as `S256`; anything else is refused.
`state`	string	No	Recommended. Returned unchanged on the redirect.

Response

A redirect. The browser is sent to the client’s login page; once the user has signed in, it comes back to redirect_uri:

https://app.acme.com/auth/callback?code=…&state=af0ifjsldkj

The code is single-use and lives for seconds: redeem it immediately with Exchange an authorization code.

Clients registered through POST /oauth/register are third-party: after signing in, the user is shown a consent screen naming the client. If they decline, the browser returns to redirect_uri with ?error=access_denied&error_description=…&state=…. Your org’s own clients skip this step.

Errors

Status	`error`	When
Redirect to `redirect_uri`	`access_denied`	The user declined the consent screen.

Example

https://acme.loginwith.dev/oauth/authorize
  ?response_type=code
  &client_id=cli_…
  &redirect_uri=https://app.acme.com/auth/callback
  &code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
  &code_challenge_method=S256
  &state=af0ifjsldkj