> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prelude.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Authorization request

> Start the authorization-code flow (RFC 6749 §4.1). Validates the
request, persists it, and `302`-redirects the browser to your login
UI with an `oauth_req` query parameter. PKCE is mandatory
(`code_challenge` with `code_challenge_method=S256`).




## OpenAPI

````yaml get /v1/session/oauth/authorize
openapi: 3.1.1
info:
  title: Prelude Auth Frontend API
  version: 0.0.1
  description: The Prelude Frontend API for Authentication and Session Management
  contact:
    email: support@prelude.so
servers:
  - url: https://{appId}.session.prelude.dev
    description: Production server
    variables:
      appId:
        default: changeme
        description: The appID
security: []
tags:
  - name: Login OTP
    description: Login and step-up via OTP (phone or email)
  - name: Login Email Password
    description: Login via email and password
  - name: Login OAuth
    description: Login via OAuth providers
  - name: Login SAML
    description: Login via SAML 2.0 SSO connections (Okta, Google Workspace)
  - name: Login Finalize
    description: Finalize a login flow and create a session
  - name: Login Migration
    description: Migrate sessions from a legacy authentication system
  - name: Session
    description: Session refresh and revocation
  - name: Session Management
    description: Authenticated session and identifier management
  - name: Step-Up
    description: Step-up authentication flow
  - name: Well-Known
    description: Public key and authorization-server discovery endpoints
  - name: OAuth Server
    description: >-
      OAuth 2.0 authorization-server endpoints that let MCP clients and other
      third-party apps sign your users in
  - name: Password
    description: Password compliancy and change password
  - name: Passkey Login
    description: >-
      Primary-factor (passwordless) sign-in via WebAuthn discoverable
      credentials
  - name: Passkey Management
    description: >-
      Register / list / rename / delete the authenticated user's passkey
      credentials
paths:
  /v1/session/oauth/authorize:
    get:
      tags:
        - OAuth Server
      summary: Authorization request
      description: |
        Start the authorization-code flow (RFC 6749 §4.1). Validates the
        request, persists it, and `302`-redirects the browser to your login
        UI with an `oauth_req` query parameter. PKCE is mandatory
        (`code_challenge` with `code_challenge_method=S256`).
      operationId: oauthServerAuthorize
      parameters:
        - in: query
          name: client_id
          required: true
          description: >-
            The client identifier — an `oac_`-prefixed id, or an `https` Client
            ID Metadata Document URL.
          schema:
            type: string
            examples:
              - oac_01jqebhswje1ka1z7ahr9rfsgt
        - in: query
          name: redirect_uri
          required: true
          description: >-
            Where to return the user after consent. Must match one registered
            for the client.
          schema:
            type: string
            examples:
              - https://mcp.example.com/oauth/callback
        - in: query
          name: response_type
          required: true
          description: Must be `code`.
          schema:
            type: string
            enum:
              - code
        - in: query
          name: code_challenge
          required: true
          description: PKCE code challenge (RFC 7636).
          schema:
            type: string
            examples:
              - E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
        - in: query
          name: code_challenge_method
          required: false
          description: PKCE method. Only `S256` is supported; defaults to `S256`.
          schema:
            type: string
            enum:
              - S256
        - in: query
          name: scope
          required: false
          description: Space-delimited requested scopes.
          schema:
            type: string
            examples:
              - mcp:read mcp:write
        - in: query
          name: state
          required: false
          description: Opaque value echoed back on the redirect to prevent CSRF.
          schema:
            type: string
      responses:
        '302':
          description: Redirect to your login UI with the `oauth_req` parameter.
          headers:
            Location:
              schema:
                type: string
              description: Your login UI's sign-in URL with `?oauth_req=<oar_...>`.
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestError'
        '500':
          description: Internal Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalError'
components:
  schemas:
    BadRequestError:
      type: object
      properties:
        code:
          type: string
          enum:
            - bad_request
        type:
          type: string
          enum:
            - bad_request
    InternalError:
      type: object
      properties:
        code:
          type: string
          enum:
            - internal
        type:
          type: string
          enum:
            - internal

````