Skip to content
GitmoapAPIBeta
Identity & platformoauth
GET/oauth/authorize

Start connecting an app: checks the request and sends the browser to the consent page

oauth_authorize
  • Public
    This operation declares no security requirement: it takes no token.
  • Redirects · 302
    Declares 302 Found.

The OAuth 2.1 authorization endpoint, for the authorization code flow with PKCE (S256), issuing access to this deployment's MCP service only. Anyone may call it, without signing in, and it records nothing: a valid request goes to the consent page unchanged, one whose app or redirect cannot be trusted goes to an error page instead of the redirect, and any other refusal returns to the app's redirect with an OAuth error. A parameter sent twice is refused.

Parameters

Query
  • response_typestringAlways code
  • client_idstringThe app's identifier — a URL for an app that publishes a metadata document
  • redirect_uristringWhere the app receives the result; must be one it registered
  • code_challengestringThe PKCE S256 challenge
  • code_challenge_methodstringAlways S256
  • resourcestringThe service the access is for: this deployment's MCP address
  • scopestringoptionalSpace-separated scopes or bundles; the agent read bundle when omitted
  • statestringoptionalReturned to the app unchanged

Responses

302To the consent page, to the error page when the app or its redirect is in doubt, or back to the app with a refusal

No body.

501The authorization server is not configured on this deploymentapplication/json
Error codes
  • NOT_IMPLEMENTEDThis deployment has not configured the feature the operation needs; the message names it
  • errorErrorBody
    • The ErrorBody schema
    • codestringThe coarse category, tied to the status: NOT_FOUND, CONFLICT, INSUFFICIENT_SCOPE. Every error has one; the API reference's error catalogue lists them all.
    • messagestringWhat went wrong, for a person. Written to be read, not parsed: match on reason or code.
    • fieldstring or nulloptionalOn a 400 that refused one field's value, the field, as its JSON path: email, items[0].name. Put the message under that input. Absent on every other error.
    • reasonstring or nulloptionalThe specific code, when the error has one: LAST_ORGANIZATION_OWNER, BRANCH_PROTECTED. The message starts with it too. Match on this when it is present, and on code otherwise.
    • required_scopestring or nulloptionalThe scope the access token was missing, on INSUFFICIENT_SCOPE.
    • violationsanyoptionalPresent on the structured-validation errors (PROVIDER_VALIDATION_FAILED per-node, PIPELINE_VALIDATION_FAILED DAG): a JSON array of the offending elements, so a caller can fix every one in a single round-trip. Absent (omitted) on every other error.
501 exampleSynthesized example
{
"error": {
"code": "code-450e",
"message": "Pin a page's payload to the build that rendered it"
}
}

CLI

gitmoap oauth oauth-authorize

  • --client-idstringThe app's identifier — a URL for an app that publishes a metadata document
  • --code-challengestringThe PKCE S256 challenge
  • --code-challenge-methodstringAlways `S256`
  • --redirect-uristringWhere the app receives the result; must be one it registered
  • --resourcestringThe service the access is for: this deployment's MCP address
  • --response-typestringAlways `code`
  • --scopestringoptionalSpace-separated scopes or bundles; the agent read bundle when omitted
  • --statestringoptionalReturned to the app unchanged