Begin an OAuth 2.0 authorization request

GET

/v1/oauth/authorize

const url = 'https://api.infiniteaudience.ai/v1/oauth/authorize?response_type=code&client_id=example&redirect_uri=https%3A%2F%2Fexample.com&code_challenge=example&code_challenge_method=S256';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://api.infiniteaudience.ai/v1/oauth/authorize?response_type=code&client_id=example&redirect_uri=https%3A%2F%2Fexample.com&code_challenge=example&code_challenge_method=S256'

Public — no bearer token. Redirect your user’s browser here to start the standard OAuth 2.0 authorization-code flow with PKCE (RFC 6749 + RFC 7636). code_challenge_method must be S256 — plain is rejected (RFC 9700). On success, the browser is eventually redirected back to your redirect_uri with a code (and your state, if you sent one) to exchange at POST /v1/oauth/token. On a validation failure, the browser is redirected back with error and error_description instead (RFC 6749 §4.1.2.1) — except an unknown client_id or an unregistered redirect_uri, which return 400 JSON directly rather than a redirect, since there is no verified address yet to redirect to.

Parameters

Query Parameters

response_type

required

string

Allowed values: code

client_id

required

string

redirect_uri

required

string format: uri

scope

string

Space-delimited scopes (discovery, purchase). Defaults to discovery.

resource

string format: uri

RFC 8707 resource URI. Required for public MCP/A2A clients. A pre-registered confidential client that omits it receives a REST-bound token.

state

string

Opaque value echoed back on both the success and error redirects.

code_challenge

required

string

code_challenge_method

required

string

Allowed values: S256

Responses

302

Redirects to the consent page on success, or back to your redirect_uri with error/error_description (and state, if you sent one) on a validation failure that occurred after redirect_uri was verified.

400

RFC 6749-shaped OAuth protocol error — error is a fixed machine-readable code and error_description is a human-readable detail. Deliberately NOT this API’s usual {error, code, message} shape — this is the RFC’s own error contract, used only by /v1/oauth/authorize, /v1/oauth/token, and /v1/oauth/revoke.

application/json

RFC 6749 §5.2 / §4.1.2.1 error body — see the OAuthError response component.

object

error

required

string

Allowed values: invalid_request invalid_client invalid_client_metadata invalid_grant invalid_scope invalid_target unsupported_response_type unsupported_grant_type access_denied server_error

error_description

required

string

Example

{
  "error": "invalid_request"
}