OAuth 2.0 authorization endpoints for third-party integrations

Redirect to React consent page.Direct link to heading

Get /oauth/authorize

Query Parameters (handled by Authlib):

• client_id: OAuth client identifier
• redirect_uri: Where to redirect after authorization
• response_type: Must be 'code'
• scope: Space-separated list of requested scopes
• state: CSRF protection token (optional but recommended)
• code_challenge: PKCE code challenge
• code_challenge_method: PKCE method (usually 'S256')

Returns:

Redirect to React consent page with OAuth params and client info

Responses

• 400 Bad Request

  • Content-Type: application/json

  {
    "message": "text",
    "detail": null,
    "code": null,
    "url": null,
    "timestamp": "text",
    "type": "text"
  }
  

• 401 Unauthorized

• 403 Forbidden

• 404 Not Found

• 405 Method Not Allowed

• 409 Conflict

• 500 Internal Server Error

• Default error response

Handle user authorization decision from React consent page.Direct link to heading

Post /oauth/authorize

Query Parameters:

All OAuth params from GET (client_id, redirect_uri, state, etc.)

Form Parameters:

• confirm: 'yes' to authorize, 'no' to deny

Returns:

Redirect to client with authorization code or error

Responses

• 401 Unauthorized

• 403 Forbidden

• 404 Not Found

• 405 Method Not Allowed

• 409 Conflict

• 500 Internal Server Error

• Default error response

Issue access tokens.Direct link to heading

Post /oauth/token

Form Parameters (authorization_code grant):

• grant_type: Must be 'authorization_code'
• code: Authorization code from /authorize
• redirect_uri: Must match original request
• client_id: OAuth client identifier
• code_verifier: PKCE code verifier

Form Parameters (refresh_token grant):

• grant_type: Must be 'refresh_token'
• refresh_token: Valid refresh token
• client_id: OAuth client identifier

Returns:

JSON response with access_token (JWT), refresh_token, expires_in, etc.

Responses

• 401 Unauthorized

• 403 Forbidden

• 404 Not Found

• 405 Method Not Allowed

• 409 Conflict

• 500 Internal Server Error

• Default error response

List all active OAuth sessions for the current user.Direct link to heading

Get /oauth/sessions

Returns:

List of active sessions including client info, creation time, and scope

Responses

• 200 OK

• 401 Unauthorized

• 403 Forbidden

• 404 Not Found

• 405 Method Not Allowed

• 409 Conflict

• 500 Internal Server Error

• Default error response

Revoke a specific OAuth session by token ID.Direct link to heading

Delete /oauth/sessions/{token_id}

Args:

• token_id: UUID of the OAuth token to revoke

Returns:

• 204 No Content on success
• 404 Not Found if session doesn't exist or doesn't belong to user

Path parameters

• token_id string · uuid Required

Responses

• 204 No Content

• 401 Unauthorized

• 403 Forbidden

• 404 Not Found

• 405 Method Not Allowed

• 409 Conflict

• 500 Internal Server Error

• Default error response

Revoke all OAuth sessions (refresh tokens) for the current user across all clients.Direct link to heading

Post /oauth/revoke-all

Returns:

JSON with message and count of revoked sessions

Responses

• 200 OK

• 401 Unauthorized

• 403 Forbidden

• 404 Not Found

• 405 Method Not Allowed

• 409 Conflict

• 500 Internal Server Error

• Default error response

Revoke an access token or refresh token.Direct link to heading

Post /oauth/revoke

Form Parameters:

• token: The token to revoke (access_token or refresh_token)
• token_type_hint: Optional hint about token type ('access_token' or 'refresh_token')

Returns:

• 200 response (always returns 200 per RFC 7009, even for invalid tokens)

Responses

• 401 Unauthorized

• 403 Forbidden

• 404 Not Found

• 405 Method Not Allowed

• 409 Conflict

• 500 Internal Server Error

• Default error response

Post /oauth/register

Responses

• 401 Unauthorized

• 403 Forbidden

• 404 Not Found

• 405 Method Not Allowed

• 409 Conflict

• 500 Internal Server Error

• Default error response

Last updated 13 hours ago.