Skip to main content
GET
Authorization request

Query Parameters

client_id
string
required

The client identifier — an oac_-prefixed id, or an https Client ID Metadata Document URL.

Example:

"oac_01jqebhswje1ka1z7ahr9rfsgt"

redirect_uri
string
required

Where to return the user after consent. Must match one registered for the client.

Example:

"https://mcp.example.com/oauth/callback"

response_type
enum<string>
required

Must be code.

Available options:
code
code_challenge
string
required

PKCE code challenge (RFC 7636).

Example:

"E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"

code_challenge_method
enum<string>

PKCE method. Only S256 is supported; defaults to S256.

Available options:
S256
scope
string

Space-delimited requested scopes.

Example:

"mcp:read mcp:write"

state
string

Opaque value echoed back on the redirect to prevent CSRF.

Response

Redirect to your login UI with the oauth_req parameter.