Start or continue an OAuth/OIDC authorization request.

GET

/authorize

Code sample: Shell / cURL

curl --request GET \
  --url https://auth.example.com/authorize

Rejects response types that are disabled by the tenant OIDC policy. Internal consent continuations are accepted only from the originating live session and browser binding. With tenant assurance enabled, a default FAL of FAL3 (with fal3_requires_par) accepts only a pushed request whose request object the client signed, and refuses any other with invalid_request; FAL2 and above with fal2_requires_dpop refuse response types that return an access token (token, code token, id_token token) with unsupported_response_type. Assurance settings that cannot be read stop the request with temporarily_unavailable. A client’s minimum_ial applies whether or not assurance is on, and the scope-to-IAL map (assurance.scope_ial_requirements) for the requested scopes while it is on. A signed-in user whose identity assurance level (read from their evidence each time) is below the higher of the two is refused with access_denied, also for prompt=none, before any step-up, re-authentication or consent, since none of those can raise an IAL. When nothing is required no evidence is read; evidence that cannot be read stops the request with temporarily_unavailable. Like access_denied, it is an OAuth error code returned to the client’s redirect_uri (query, fragment or form_post), not an HTTP 503. A request that asks for prompt=login or an exceeded max_age is re-authenticated first, and the user who returns is judged then. Access tokens already issued stay valid until they expire; revoking evidence stops new authorizations, refreshes and exchanges. An id_token_hint must be an ID token this server issued (signature and issuer; it may have expired), else invalid_request; it never stands in for a session. When the signed-in End-User is not the one it names (its sub, or the sub the app’s identity mapping issues), the request ends with login_required, whether prompt=none or not. prompt=create (Initiating User Registration) is acted on only while the tenant has oauth.prompt_create_enabled on and a sign-up method is available: passkey, email code or authenticator app switched on for sign-up, or an external identity provider (social login) that the sign-up page offers and that can create the account (the provider is enabled, the tenant has not turned off its sign-up use, its own JIT provisioning is on, and the tenant’s external_idp.jit_provisioning_enabled is on and external_idp.jit_allowed_provider_ids allows it; a provider that can only link an existing account does not count). Changing those provider settings changes whether the value is acted on. When the settings cannot be read, the value is ignored. The browser then goes to the tenant’s sign-up page (tenant.ui_register_path) with the same challenge_id as the sign-in page gets, whether or not it holds a session: only an authentication made after the request completes it, and the request then continues as after any sign-in. Otherwise the value is ignored, as any prompt value is that this server does not act on. prompt=create with none is invalid_request, as none with any other value. The prompt values are the space-separated, case-sensitive whole tokens of the parameter: a value that only contains a known one (nonetheless, loginnow) is ignored. An app with its own sign-in UI (login_ui_url) is sent to that UI with the tenant’s sign-up path (the base URL is the app’s, the paths are the tenant’s).

Parameters

Query Parameters

client_id

string

redirect_uri

string

response_type

string

scope

string

state

string

id_token_hint

string

An ID token this server issued, naming the End-User the client expects (OIDC Core 3.1.2.1). Verified (signature, issuer; it may have expired) and matched to the signed-in End-User; it is a hint, never a sign-in.

ui_locales

string

Space-separated BCP 47 locale preferences in priority order. The first supported value is forwarded to Login UI as a transaction-scoped hint and does not overwrite the end-user’s saved language preference.

Responses

200

Successful response. The representation can be JSON, HTML, or a redirect.

302

Redirect response.

503

Error response.

Media type application/json

object

error

string

error_description

string

message

string

webauthn_signal

Optional browser-side WebAuthn Signal API hint. When unknown_credential is true, clients that just received a WebAuthn credential assertion may call PublicKeyCredential.signalUnknownCredential() for that credential ID.

object

unknown_credential

boolean

key

additional properties

Example ^generated

{
  "error": "example",
  "error_description": "example",
  "message": "example",
  "webauthn_signal": {
    "unknown_credential": true
  }
}