---
title: "Authorize Endpoint"
method: GET
path: "/oauth/focused/authorize"
tags: ["oauth-provider", "oauth-provider"]
---

# Authorize Endpoint

`GET /oauth/focused/authorize`

OAuth 2.1 authorization endpoint with PKCE.

Validates client, redirect URI, and scopes. Resolves user identity via
login_hint parameter, then renders consent screen in user's language.

Query Parameters:
    response_type: Must be "code"
    client_id: Registered OAuth client ID
    redirect_uri: Must match client's registered URIs
    code_challenge: PKCE code challenge (SHA256)
    code_challenge_method: Must be "S256"
    scope: Space-separated scopes (focused.read, focused.write, focused.notify)
    state: Optional CSRF token
    nonce: Optional OpenID Connect nonce
    login_hint: Optional - ChatGPT user ID for user identification
    resource: Optional - MCP server URL for JWT aud claim (RFC 9728 B2-5)

Returns:
    HTML consent screen on success
    Error redirect on validation failure

Security Notes:
    - login_hint is optional; if missing, an anonymous user is created
    - User identity resolved via login_hint → core_users.chatgpt_user_id
    - Never accept raw user_id from query params (prevents impersonation)
    - PKCE required (S256 challenge method)
    - redirect_uri must be pre-registered
    - Rate limited: by IP always, by login_hint if provided
    - Authorization context stores internal user_id (UUID), NOT chatgpt_user_id

Example:
    GET /oauth/focused/authorize?
        response_type=code&
        client_id=focused-client-123&
        redirect_uri=https://example.com/callback&
        code_challenge=abc...&
        code_challenge_method=S256&
        scope=focused.read+focused.write&
        state=xyz&
        login_hint=chatgpt_user_123

## Query parameters

- `response_type` string, required
- `client_id` string, required
- `redirect_uri` string, required
- `code_challenge` string, required
- `code_challenge_method` string, required
- `scope` string, required
- `state` string, nullable
- `nonce` string, nullable
- `login_hint` string, nullable
- `resource` string, nullable

## Response `200`

Successful Response

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/priority-guard/apis/priority-guardian.md) · [All operations](https://skmtc.net/priority-guard/apis/priority-guardian/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/priority-guard/priority-guardian/revisions/8579218b716d/schema)