---
title: "Generate OAuth authorization URL"
method: GET
path: "/api/oauth/auth-url"
tags: ["oauth"]
---

# Generate OAuth authorization URL

`GET /api/oauth/auth-url`

Generate OAuth authorization URL with state and nonce for CSRF and replay attack protection. State is stored with TTL for validation.

## Query parameters

- `redirect_uri` string, required — The URI to redirect to after OAuth consent. Must match the registered redirect URI in OAuth client configuration.
- `code_challenge` string, nullable — PKCE code challenge derived from code_verifier. Required for public clients to prevent authorization code interception attacks.
- `code_challenge_method` string, nullable — PKCE code challenge method, typically 'S256' (SHA-256 hash). Must be provided if code_challenge is specified.

## Response `200`

Successful Response

- AuthUrlResponse — Response containing OAuth authorization URL
  - `url` string, uri, required — OAuth provider authorization URL to redirect the user to for consent

## Other responses

- `422` — Validation Error
- `429` — Rate limit exceeded. Retry after the interval in the `Retry-After` header.

---

[API](https://skmtc.net/gumnut-ai/apis/gumnut-api.md) · [All operations](https://skmtc.net/gumnut-ai/apis/gumnut-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/gumnut-ai/gumnut-api/versions/e71db45f5d4a/schema)