Authorization request
Start the authorization-code flow (RFC 6749 §4.1). Validates the
request, persists it, and 302-redirects the browser to your login
UI with an oauth_req query parameter. PKCE is mandatory
(code_challenge with code_challenge_method=S256).
Query Parameters
The client identifier — an oac_-prefixed id, or an https Client ID Metadata Document URL.
"oac_01jqebhswje1ka1z7ahr9rfsgt"
Where to return the user after consent. Must match one registered for the client.
"https://mcp.example.com/oauth/callback"
Must be code.
code PKCE code challenge (RFC 7636).
"E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"
PKCE method. Only S256 is supported; defaults to S256.
S256 Space-delimited requested scopes.
"mcp:read mcp:write"
Opaque value echoed back on the redirect to prevent CSRF.
Response
Redirect to your login UI with the oauth_req parameter.