---
title: "Authorize"
method: GET
path: "/vault/authorize/{service_id}/{application_id}"
tags: ["Connections"]
---

# Authorize

`GET /vault/authorize/{service_id}/{application_id}`

__In most cases the authorize link is provided in the ``/connections`` endpoint. Normally you don't need to manually generate these links.__

Use this endpoint to authenticate a user with a connector. It will return a 301 redirect to the downstream connector endpoints.

Auth links will have a state parameter included to verify the validity of the request. This is the url your users will use to activate OAuth supported integration providers.

Vault handles the complete Authorization Code Grant Type Flow for you and will redirect you to the dynamic redirect uri you have appended to the url in case this is missing the default redirect uri you have configured for your Unify application.

## CSRF protection with `nonce` (two-step confirmation)

Optionally pass a `nonce` query parameter to enable CSRF-protected authorization. When a `nonce` is supplied and CSRF protection is enabled for your account, the OAuth flow changes from a single step to **two steps**:

1. Vault completes the OAuth exchange but stores the credentials as **unconfirmed** (`confirmed: false`). The connection is **not** callable yet.
2. The callback redirect URL is returned with a hash fragment containing the original `nonce`, a short-lived `confirm_token`, and the `service_id`: `#nonce=<nonce>&confirm_token=<token>&service_id=<service_id>`.

Your application **must** verify the returned `nonce` matches the value it sent, then call `POST /vault/connections/{unified_api}/{service_id}/confirm` with the `confirm_token` to confirm and activate the connection. Until the connection is confirmed it will not be callable. The `confirm_token` expires after 30 minutes.

If no `nonce` is supplied (or CSRF protection is not enabled), the legacy single-step flow is used and the connection becomes callable immediately after the callback — no confirmation step is required.

## Path parameters

- `service_id` string, required
- `application_id` string, required

## Query parameters

- `state` string, required
- `redirect_uri` string, required
- `scope` string[]
- `nonce` string

## Response `default`

Unexpected error

- UnexpectedErrorResponse
  - `status_code` number — HTTP status code
  - `error` string — Contains an explanation of the status_code as defined in HTTP/1.1 standard (RFC 7231)
  - `type_name` string — The type of error returned
  - `message` string — A human-readable message providing more details about the error.
  - `detail` union — Contains parameter or domain specific information related to the error and why it occurred.
    - string
    - object
  - `ref` string — Link to documentation of error type

## Other responses

- `301` — redirect
- `400` — Bad Request
- `401` — Unauthorized
- `402` — Payment Required
- `404` — The specified resource was not found
- `422` — Unprocessable

---

[API](https://skmtc.net/apideck-libraries/apis/vault-api.md) · [All operations](https://skmtc.net/apideck-libraries/apis/vault-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/apideck-libraries/vault-api/versions/1b8e8b6feb36/schema)