---
title: "Generate OAuth URL to link a subscriber user identity"
method: POST
path: "/v1/integrations/channel-endpoints/oauth"
tags: ["Integrations"]
---

# Generate OAuth URL to link a subscriber user identity

`POST /v1/integrations/channel-endpoints/oauth`

Generate an OAuth URL that links a specific subscriber to their chat identity (Slack user ID, MS Teams user OID, or Webex person).
    The generated URL expires after 5 minutes.

## Request body

- GenerateLinkUserOauthUrlRequestDto
  - `subscriberId` string, required — The subscriber ID to link to their chat identity. Required — this operation always binds a specific subscriber to a user identity in the chat provider.
  - `integrationIdentifier` string, required — Integration identifier
  - `connectionIdentifier` string — Identifier of the existing channel connection to associate this user endpoint with. Generated automatically if not provided for providers that support standalone user linking. Required for Webex.
  - `context` object
  - `contextHash` string — HMAC-SHA256 of the canonicalized `context`, signed with the tenant environment secret key (the same "Inbox with context" signing scheme). Required when the integration has HMAC validation enabled and the session did not already HMAC-verify the context, so the per-user link carries a trustworthy subscriber/tenant binding.
  - `userScope` string[] — **Slack only**: User-level OAuth scopes for "Sign in with Slack". Defaults to: identity.basic. **Webex**: Optional Webex scopes for people/me; defaults to spark:people_read. **MS Teams**: ignored — uses delegated OpenID scopes (openid, profile, User.Read).

## Response `201`

Created

- GenerateChatOAuthUrlResponseDto
  - `url` string, required — The OAuth authorization URL for the chat provider. For Slack: https://slack.com/oauth/v2/authorize?... For MS Teams: https://login.microsoftonline.com/.../adminconsent?... This URL should be presented to the user to authorize the integration. Expires after 5 minutes.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `405` — Method Not Allowed
- `409` — Conflict
- `413` — Payload Too Large
- `414` — URI Too Long
- `415` — Unsupported Media Type
- `422` — Unprocessable Entity
- `429` — The client has sent too many requests in a given amount of time.
- `500` — Internal Server Error
- `503` — The server is currently unable to handle the request due to a temporary overload or scheduled maintenance, which will likely be alleviated after some delay.

---

[API](https://skmtc.net/novu/apis/deprecated-novu-api-use-openapi-json-yaml-instead.md) · [All operations](https://skmtc.net/novu/apis/deprecated-novu-api-use-openapi-json-yaml-instead/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/novu/deprecated-novu-api-use-openapi-json-yaml-instead/versions/986fe259fa85/schema)