> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prelude.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Continue authorization after login

> Called by your login UI once the user has signed in. Attaches the
authenticated user to the authorization request and returns the URL of
the consent screen to navigate to next. Bound to the live session with
an access token and a DPoP proof — the Web SDK issues this call for you.




## OpenAPI

````yaml post /v1/session/oauth/continue
openapi: 3.1.1
info:
  title: Prelude Auth Frontend API
  version: 0.0.1
  description: The Prelude Frontend API for Authentication and Session Management
  contact:
    email: support@prelude.so
servers:
  - url: https://{appId}.session.prelude.dev
    description: Production server
    variables:
      appId:
        default: changeme
        description: The appID
security: []
tags:
  - name: Login OTP
    description: Login and step-up via OTP (phone or email)
  - name: Login Email Password
    description: Login via email and password
  - name: Login OAuth
    description: Login via OAuth providers
  - name: Login SAML
    description: Login via SAML 2.0 SSO connections (Okta, Google Workspace)
  - name: Login Finalize
    description: Finalize a login flow and create a session
  - name: Login Migration
    description: Migrate sessions from a legacy authentication system
  - name: Session
    description: Session refresh and revocation
  - name: Session Management
    description: Authenticated session and identifier management
  - name: Step-Up
    description: Step-up authentication flow
  - name: Well-Known
    description: Public key and authorization-server discovery endpoints
  - name: OAuth Server
    description: >-
      OAuth 2.0 authorization-server endpoints that let MCP clients and other
      third-party apps sign your users in
  - name: Password
    description: Password compliancy and change password
  - name: Passkey Login
    description: >-
      Primary-factor (passwordless) sign-in via WebAuthn discoverable
      credentials
  - name: Passkey Management
    description: >-
      Register / list / rename / delete the authenticated user's passkey
      credentials
paths:
  /v1/session/oauth/continue:
    post:
      tags:
        - OAuth Server
      summary: Continue authorization after login
      description: |
        Called by your login UI once the user has signed in. Attaches the
        authenticated user to the authorization request and returns the URL of
        the consent screen to navigate to next. Bound to the live session with
        an access token and a DPoP proof — the Web SDK issues this call for you.
      operationId: oauthContinue
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuthContinueRequest'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthRedirectResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedError'
        '500':
          description: Internal Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalError'
      security:
        - accessTokenAuth: []
          dpopProofAuth: []
components:
  schemas:
    OAuthContinueRequest:
      type: object
      properties:
        oauth_req:
          type: string
          description: The authorization request id from the `/authorize` redirect.
          examples:
            - oar_01jqebhswje1ka1z7ahr9rfsgt
      required:
        - oauth_req
    OAuthRedirectResponse:
      type: object
      properties:
        redirect_url:
          type: string
          description: The URL the browser should navigate to next.
          examples:
            - >-
              https://auth.example.com/oauth/consent?oauth_req=oar_01jqebhswje1ka1z7ahr9rfsgt
      required:
        - redirect_url
    BadRequestError:
      type: object
      properties:
        code:
          type: string
          enum:
            - bad_request
        type:
          type: string
          enum:
            - bad_request
    UnauthorizedError:
      type: object
      properties:
        code:
          type: string
          enum:
            - unauthorized
        type:
          type: string
          enum:
            - unauthorized
    InternalError:
      type: object
      properties:
        code:
          type: string
          enum:
            - internal
        type:
          type: string
          enum:
            - internal
  securitySchemes:
    accessTokenAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Access token obtained from session refresh
    dpopProofAuth:
      type: apiKey
      in: header
      name: DPoP
      description: |
        DPoP proof JWT (RFC 9449) bound to the calling session's key. Required
        alongside the access token on the OAuth login-UI endpoints
        (`/oauth/continue`, `/oauth/pending`, `/oauth/decision`). The Web SDK
        constructs and rotates this proof for you.

````