Sign in

v51

latestSwagger 2.0raw.githubusercontent.com2026-08-015253175.3 KB
oAuth2

Get OAuth 2.0 Login Request

When an authorization code, hybrid, or implicit OAuth 2.0 Flow is initiated, Ory asks the login provider to authenticate the subject and then tell the Ory OAuth2 Service about it.

Per default, the login provider is Ory itself. You may use a different login provider which needs to be a web-app you write and host, and it must be able to authenticate ("show the subject a login screen") a subject (in OAuth2 the proper name for subject is "resource owner").

The authentication challenge is appended to the login provider URL to which the subject's user-agent (browser) is redirected to. The login provider uses that challenge to fetch information on the OAuth2 request and then accept or reject the requested authentication process.

get/admin/oauth2/auth/requests/login

Query parameters

login_challengestring required

OAuth 2.0 Login Request Challenge

Response

oAuth2LoginRequest

challengestring required

ID is the identifier of the login request.

request_urlstring required

RequestURL is the original OAuth 2.0 Authorization URL requested by the OAuth 2.0 client. It is the URL which initiates the OAuth 2.0 Authorization Code or OAuth 2.0 Implicit flow. This URL is typically not needed, but might come in handy if you want to deal with additional request parameters.

requested_access_token_audiencestring[]

RequestedAudience contains the access token audience as requested by the OAuth 2.0 Client.

requested_scopestring[]

RequestedScope contains the OAuth 2.0 Scope requested by the OAuth 2.0 Client.

session_idstring

SessionID is the login session ID. If the user-agent reuses a login session (via cookie / remember flag) this ID will remain the same. If the user-agent did not have an existing authentication session (e.g. remember is false) this will be a new random value. This value is used as the "sid" parameter in the ID Token and in OIDC Front-/Back- channel logout. It's value can generally be used to associate consecutive login requests by a certain user.

skipboolean required

Skip, if true, implies that the client has requested the same scopes from the same user previously. If true, you can skip asking the user to grant the requested scopes, and simply forward the user to the redirect URL.

This feature allows you to update / set session information.

subjectstring required

Subject is the user ID of the end-user that authenticated. Now, that end user needs to grant or deny the scope requested by the OAuth 2.0 client. If this value is set and skip is true, you MUST include this subject type when accepting the login request, or the request will fail.

Example response

{
  "client": {
    "scope": "scope1 scope-2 scope.3 scope:4"
  }
}