Authorize an application
Opened in the customer's browser, never called by the application's server. Customers who are not signed in sign in first, then approve or cancel. The store then redirects to redirect_uri with code and state, or with error=access_denied when the customer cancels.
Query Parameters
The application's client ID.
One of the application's redirect URLs, exactly as registered.
Always code.
"code"Space separated scopes. Defaults to profile.
Random value returned unchanged with the code, to be checked by the application.
PKCE: base64url of the SHA-256 of the code verifier. Required for public applications.
PKCE: always S256.
"S256"consent shows the approval screen even when the customer approved these scopes before, login asks them to sign in again, none fails instead of showing any screen.
"none" | "login" | "consent"Response Body
application/json
application/json
curl -X GET "http://localhost:8000/oauth2/authorize?client_id=9f3c2a1e-7d4b-4c6a-9e1f-2b3c4d5e6f70&redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback&response_type=code&scope=profile+email&state=Qx81"{
"error": "string",
"error_description": "string",
"hint": "string",
"message": "string"
}{
"error": "string",
"error_description": "string",
"hint": "string",
"message": "string"
}