Skip to content
go-api-boilerplate

An OAuth 2 authorization request (RFC 6749 §4.1.1).

GET
/oauth/authorize
curl --request GET \
  --url 'https://example.com/api/auth/oauth/authorize?response_type=code&client_id=example&redirect_uri=https%3A%2F%2Fexample.com&code_challenge=example&code_challenge_method=S256'

Only the authorization code flow, and only with PKCE S256. The user agent is sent:

  • to {WEB_URL}/oauth/error?reason=… for any bad request, with one of the OAuthErrorReason values, signed in or not;
  • to {WEB_URL}/sign-in?next=… without a session;
  • to {WEB_URL}/consent?request=… with one.

It is never sent back to the redirect_uri from here, not even with an error: any user can register a client, so that would be an open redirector (RFC 9700 §4.11.2). Only the consent page’s answer goes back to the client.

Parameters

Section titled “Parameters”

Query Parameters

Section titled “Query Parameters”
response_type
required
string
Allowed value: code
client_id
required
string
redirect_uri
required
string format: uri
scope
string

Space-separated; the client’s scopes when omitted.

state
string
<= 1024 characters
code_challenge
required
string
>= 43 characters <= 43 characters
code_challenge_method
required
string
Allowed value: S256

Responses

Section titled “Responses”

302

Section titled “302”

The user agent is sent on; see the operation.

Headers

Section titled “Headers”
Location
required
string format: uri-reference

500

Section titled “500”

The service failed; the problem says nothing more.

Media typeapplication/problem+json

An RFC 9457 problem.

object
type
required
string
title
required
string
status
required
integer
detail
string
instance
string
request_id
string
errors
object
key
additional properties
string

Example generated

{
  "type": "example",
  "title": "example",
  "status": 1,
  "detail": "example",
  "instance": "example",
  "request_id": "example",
  "errors": {
    "additionalProperty": "example"
  }
}