OAuth

OAuth 2.0 authorization endpoints for third-party integrations

Redirect to React consent page.

get

Query Parameters (handled by Authlib): client_id: OAuth client identifier redirect_uri: Where to redirect after authorization response_type: Must be 'code' scope: Space-separated list of requested scopes state: CSRF protection token (optional but recommended) code_challenge: PKCE code challenge code_challenge_method: PKCE method (usually 'S256')

Returns: Redirect to React consent page with OAuth params and client info

Responses

400

Bad request

application/json

messagestringRequired

detailanyOptional

codestring · nullableOptional

urlstring · nullableOptional

timestampstringRequired

typestringRequired

401

Unauthorized

application/json

403

Forbidden

application/json

404

Not found

application/json

405

Method not allowed

application/json

409

Conflict

application/json

500

Internal server error

application/json

default

Default error response

application/json

get/oauth/authorize

GET /oauth/authorize HTTP/1.1
Accept: */*

{
  "message": "text",
  "detail": null,
  "code": null,
  "url": null,
  "timestamp": "text",
  "type": "text"
}

Handle user authorization decision from React consent page.

post

Query Parameters: All OAuth params from GET (client_id, redirect_uri, state, etc.)

Form Parameters: confirm: 'yes' to authorize, 'no' to deny

Returns: Redirect to client with authorization code or error

Responses

400

Bad request

application/json

messagestringRequired

detailanyOptional

codestring · nullableOptional

urlstring · nullableOptional

timestampstringRequired

typestringRequired

401

Unauthorized

application/json

403

Forbidden

application/json

404

Not found

application/json

405

Method not allowed

application/json

409

Conflict

application/json

500

Internal server error

application/json

default

Default error response

application/json

post/oauth/authorize

POST /oauth/authorize HTTP/1.1
Accept: */*

{
  "message": "text",
  "detail": null,
  "code": null,
  "url": null,
  "timestamp": "text",
  "type": "text"
}

Issue access tokens.

post

Form Parameters (authorization_code grant): grant_type: Must be 'authorization_code' code: Authorization code from /authorize redirect_uri: Must match original request client_id: OAuth client identifier code_verifier: PKCE code verifier

Form Parameters (refresh_token grant): grant_type: Must be 'refresh_token' refresh_token: Valid refresh token client_id: OAuth client identifier

Returns: JSON response with access_token (JWT), refresh_token, expires_in, etc.

Responses

400

Bad request

application/json

messagestringRequired

detailanyOptional

codestring · nullableOptional

urlstring · nullableOptional

timestampstringRequired

typestringRequired

401

Unauthorized

application/json

403

Forbidden

application/json

404

Not found

application/json

405

Method not allowed

application/json

409

Conflict

application/json

500

Internal server error

application/json

default

Default error response

application/json

post/oauth/token

POST /oauth/token HTTP/1.1
Accept: */*

{
  "message": "text",
  "detail": null,
  "code": null,
  "url": null,
  "timestamp": "text",
  "type": "text"
}

List all active OAuth sessions for the current user.

get

Returns: List of active sessions including client info, creation time, and scope

Responses

200

application/json

token_idstringRequiredPattern: [0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\Z

client_namestringRequired

client_idstringRequired

created_atintegerRequired

scopestringRequired

400

Bad request

application/json

401

Unauthorized

application/json

403

Forbidden

application/json

404

Not found

application/json

405

Method not allowed

application/json

409

Conflict

application/json

500

Internal server error

application/json

default

Default error response

application/json

get/oauth/sessions

GET /oauth/sessions HTTP/1.1
Accept: */*

[
  {
    "token_id": "text",
    "client_name": "text",
    "client_id": "text",
    "created_at": 1,
    "scope": "text"
  }
]

Revoke a specific OAuth session by token ID.

delete

Args: token_id: UUID of the OAuth token to revoke

Returns: 204 No Content on success 404 Not Found if session doesn't exist or doesn't belong to user

Path parameters

token_idstring · uuidRequired

Responses

204

No Content

No content

400

Bad request

application/json

401

Unauthorized

application/json

403

Forbidden

application/json

404

Not found

application/json

405

Method not allowed

application/json

409

Conflict

application/json

500

Internal server error

application/json

default

Default error response

application/json

delete/oauth/sessions/{token_id}

DELETE /oauth/sessions/{token_id} HTTP/1.1
Accept: */*

No content

Revoke all OAuth sessions (refresh tokens) for the current user across all clients.

post

Returns: JSON with message and count of revoked sessions

Responses

200

application/json

messagestringRequired

countintegerRequired

400

Bad request

application/json

401

Unauthorized

application/json

403

Forbidden

application/json

404

Not found

application/json

405

Method not allowed

application/json

409

Conflict

application/json

500

Internal server error

application/json

default

Default error response

application/json

post/oauth/revoke-all

POST /oauth/revoke-all HTTP/1.1
Accept: */*

{
  "message": "text",
  "count": 1
}

Revoke an access token or refresh token.

post

Form Parameters: token: The token to revoke (access_token or refresh_token) token_type_hint: Optional hint about token type ('access_token' or 'refresh_token')

Returns: 200 response (always returns 200 per RFC 7009, even for invalid tokens)

Responses

400

Bad request

application/json

messagestringRequired

detailanyOptional

codestring · nullableOptional

urlstring · nullableOptional

timestampstringRequired

typestringRequired

401

Unauthorized

application/json

403

Forbidden

application/json

404

Not found

application/json

405

Method not allowed

application/json

409

Conflict

application/json

500

Internal server error

application/json

default

Default error response

application/json

post/oauth/revoke

POST /oauth/revoke HTTP/1.1
Accept: */*

{
  "message": "text",
  "detail": null,
  "code": null,
  "url": null,
  "timestamp": "text",
  "type": "text"
}

post

Responses

400

Bad request

application/json

messagestringRequired

detailanyOptional

codestring · nullableOptional

urlstring · nullableOptional

timestampstringRequired

typestringRequired

401

Unauthorized

application/json

403

Forbidden

application/json

404

Not found

application/json

405

Method not allowed

application/json

409

Conflict

application/json

500

Internal server error

application/json

default

Default error response

application/json

post/oauth/register

POST /oauth/register HTTP/1.1
Accept: */*

{
  "message": "text",
  "detail": null,
  "code": null,
  "url": null,
  "timestamp": "text",
  "type": "text"
}

PreviousWell Known NextModels

Last updated 19 hours ago

Was this helpful?