> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prelude.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Submit consent decision

> Submit the user's Approve or Deny decision. Returns the client
`redirect_uri` to send the browser to — with a `code` (and `state`) on
approval, or `error=access_denied` on denial. Bound to the live
session with an access token and a DPoP proof.




## OpenAPI

````yaml post /v1/session/oauth/decision
openapi: 3.1.1
info:
  title: Prelude Auth Frontend API
  version: 0.0.1
  description: The Prelude Frontend API for Authentication and Session Management
  contact:
    email: support@prelude.so
servers:
  - url: https://{appId}.session.prelude.dev
    description: Production server
    variables:
      appId:
        default: changeme
        description: The appID
security: []
tags:
  - name: Login OTP
    description: Login and step-up via OTP (phone or email)
  - name: Login Email Password
    description: Login via email and password
  - name: Login OAuth
    description: Login via OAuth providers
  - name: Login SAML
    description: Login via SAML 2.0 SSO connections (Okta, Google Workspace)
  - name: Login Finalize
    description: Finalize a login flow and create a session
  - name: Login Migration
    description: Migrate sessions from a legacy authentication system
  - name: Session
    description: Session refresh and revocation
  - name: Session Management
    description: Authenticated session and identifier management
  - name: Step-Up
    description: Step-up authentication flow
  - name: Well-Known
    description: Public key and authorization-server discovery endpoints
  - name: OAuth Server
    description: >-
      OAuth 2.0 authorization-server endpoints that let MCP clients and other
      third-party apps sign your users in
  - name: Password
    description: Password compliancy and change password
  - name: Passkey Login
    description: >-
      Primary-factor (passwordless) sign-in via WebAuthn discoverable
      credentials
  - name: Passkey Management
    description: >-
      Register / list / rename / delete the authenticated user's passkey
      credentials
paths:
  /v1/session/oauth/decision:
    post:
      tags:
        - OAuth Server
      summary: Submit consent decision
      description: |
        Submit the user's Approve or Deny decision. Returns the client
        `redirect_uri` to send the browser to — with a `code` (and `state`) on
        approval, or `error=access_denied` on denial. Bound to the live
        session with an access token and a DPoP proof.
      operationId: oauthDecision
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OAuthDecisionRequest'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/OAuthRedirectResponse'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BadRequestError'
        '401':
          description: Unauthorized
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UnauthorizedError'
        '500':
          description: Internal Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/InternalError'
      security:
        - accessTokenAuth: []
          dpopProofAuth: []
components:
  schemas:
    OAuthDecisionRequest:
      type: object
      properties:
        oauth_req:
          type: string
          examples:
            - oar_01jqebhswje1ka1z7ahr9rfsgt
        approve:
          type: boolean
          description: '`true` to approve consent, `false` to deny.'
          examples:
            - true
      required:
        - oauth_req
        - approve
    OAuthRedirectResponse:
      type: object
      properties:
        redirect_url:
          type: string
          description: The URL the browser should navigate to next.
          examples:
            - >-
              https://auth.example.com/oauth/consent?oauth_req=oar_01jqebhswje1ka1z7ahr9rfsgt
      required:
        - redirect_url
    BadRequestError:
      type: object
      properties:
        code:
          type: string
          enum:
            - bad_request
        type:
          type: string
          enum:
            - bad_request
    UnauthorizedError:
      type: object
      properties:
        code:
          type: string
          enum:
            - unauthorized
        type:
          type: string
          enum:
            - unauthorized
    InternalError:
      type: object
      properties:
        code:
          type: string
          enum:
            - internal
        type:
          type: string
          enum:
            - internal
  securitySchemes:
    accessTokenAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: Access token obtained from session refresh
    dpopProofAuth:
      type: apiKey
      in: header
      name: DPoP
      description: |
        DPoP proof JWT (RFC 9449) bound to the calling session's key. Required
        alongside the access token on the OAuth login-UI endpoints
        (`/oauth/continue`, `/oauth/pending`, `/oauth/decision`). The Web SDK
        constructs and rotates this proof for you.

````