> ## Documentation Index
> Fetch the complete documentation index at: https://gproxy.leenhawk.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GET /v1/oauth/authorize

> Accept: text/html redirects to consent without authentication. JSON details require a console session or management API key.



## OpenAPI

````yaml /generated/openapi.json get /v1/oauth/authorize
openapi: 3.1.0
info:
  description: >-
    Forwarding, management, portal and OAuth APIs generated from Rust types.
    Input and output schemas preserve their respective Serde contracts.
    Streaming events and WebSocket messages are documented alongside HTTP
    payloads.
  title: GPROXY HTTP API
  version: 4.2.1
servers: []
security:
  - bearer: []
  - anthropicKey: []
  - googleKey: []
  - queryKey: []
paths:
  /v1/oauth/authorize:
    get:
      tags:
        - OAuth
      summary: GET /v1/oauth/authorize
      description: >-
        Accept: text/html redirects to consent without authentication. JSON
        details require a console session or management API key.
      parameters:
        - description: ''
          in: query
          name: client_id
          required: false
          schema:
            default: ''
            type: string
        - description: The base64url SHA-256 of the client's verifier (RFC 7636 §4.2).
          in: query
          name: code_challenge
          required: false
          schema:
            default: ''
            description: The base64url SHA-256 of the client's verifier (RFC 7636 §4.2).
            type: string
        - description: Must be `S256`.
          in: query
          name: code_challenge_method
          required: false
          schema:
            default: ''
            description: Must be `S256`.
            type: string
        - description: Matched **exactly** against `oauth_clients.redirect_uris`.
          in: query
          name: redirect_uri
          required: false
          schema:
            default: ''
            description: Matched **exactly** against `oauth_clients.redirect_uris`.
            type: string
        - description: Must be `code`. This issuer has no implicit and no hybrid flow.
          in: query
          name: response_type
          required: false
          schema:
            default: ''
            description: Must be `code`. This issuer has no implicit and no hybrid flow.
            type: string
        - description: Space-delimited, per RFC 6749 §3.3. Empty asks for no scope.
          in: query
          name: scope
          required: false
          schema:
            default: ''
            description: Space-delimited, per RFC 6749 §3.3. Empty asks for no scope.
            type: string
        - description: >-
            Opaque client value, echoed back untouched on both outcomes. It is
            the

            client's CSRF defence and this issuer never interprets it.
          in: query
          name: state
          required: false
          schema:
            default: null
            description: >-
              Opaque client value, echoed back untouched on both outcomes. It is
              the

              client's CSRF defence and this issuer never interprets it.
            type:
              - string
              - 'null'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Output_AuthorizeDetails'
          description: Success
        '302':
          description: Browser consent handoff
          headers:
            Location:
              schema:
                type: string
        default:
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Output_OAuthErrorBody'
          description: OAuth error
      security:
        - consoleSession: []
        - bearer: []
        - anthropicKey: []
        - googleKey: []
        - {}
components:
  schemas:
    Output_AuthorizeDetails:
      description: >-
        What a consent screen renders, once the request has been found valid.


        Returned by
        [`Issuer::authorize_details`](crate::operations::issuer::Issuer::authorize_details),

        which validates everything an approval would validate. A screen built
        from

        this can therefore show the user a decision that will actually be
        honoured

        rather than one that fails after they take it.
      properties:
        client_id:
          type: string
        client_name:
          description: |-
            `oauth_clients.name`, which is what the user recognises. The id is a
            string a binary was compiled with and means nothing to them.
          type: string
        redirect_uri:
          description: The exact registered redirect URI the code would be delivered to.
          type: string
        scopes:
          description: The requested scopes, already split on whitespace and deduplicated.
          items:
            type: string
          type: array
        state:
          type:
            - string
            - 'null'
        user_id:
          description: The user a consent would bind the grant to.
          type: string
      required:
        - client_id
        - client_name
        - scopes
        - redirect_uri
        - state
        - user_id
      type: object
    Output_OAuthErrorBody:
      description: RFC 6749 §5.2's error body, which RFC 7009 and RFC 8628 reuse.
      properties:
        error:
          type: string
        error_description:
          type: string
      required:
        - error
        - error_description
      type: object
  securitySchemes:
    bearer:
      scheme: bearer
      type: http
    anthropicKey:
      in: header
      name: x-api-key
      type: apiKey
    googleKey:
      in: header
      name: x-goog-api-key
      type: apiKey
    queryKey:
      in: query
      name: key
      type: apiKey
    consoleSession:
      in: cookie
      name: gproxy_session
      type: apiKey

````

## Related topics

- [POST /v1/oauth/authorize](https://gproxy.leenhawk.com/api-reference/oauth/post-v1oauthauthorize.md)
- [GET /v1/oauth/metadata](https://gproxy.leenhawk.com/api-reference/oauth/get-v1oauthmetadata.md)
- [GET /v1/.well-known/oauth-authorization-server](https://gproxy.leenhawk.com/api-reference/oauth/get-v1well-knownoauth-authorization-server.md)
- [GET /.well-known/oauth-authorization-server/v1](https://gproxy.leenhawk.com/api-reference/oauth/get-well-knownoauth-authorization-serverv1.md)
- [GET /.well-known/oauth-authorization-server/{mount}/v1](https://gproxy.leenhawk.com/api-reference/oauth/get-well-knownoauth-authorization-server-v1.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.