Skip to main content
POST
Continue authorization after login

Authorizations

Authorization
string
header
required

Access token obtained from session refresh

DPoP
string
header
required

DPoP proof JWT (RFC 9449) bound to the calling session's key. Required alongside the access token on the OAuth login-UI endpoints (/oauth/continue, /oauth/pending, /oauth/decision). The Web SDK constructs and rotates this proof for you.

Body

application/json
oauth_req
string
required

The authorization request id from the /authorize redirect.

Example:

"oar_01jqebhswje1ka1z7ahr9rfsgt"

Response

OK

redirect_url
string
required

The URL the browser should navigate to next.

Example:

"https://auth.example.com/oauth/consent?oauth_req=oar_01jqebhswje1ka1z7ahr9rfsgt"