---
title: "Consent Endpoint"
method: POST
path: "/oauth/focused/consent"
tags: ["oauth-provider", "oauth-provider"]
---

# Consent Endpoint

`POST /oauth/focused/consent`

Handle user consent decision (Allow/Deny).

Form Data:
    auth_context_id: Authorization context ID from Redis
    action: "allow" or "deny"

Returns:
    Redirect to client's redirect_uri with:
    - code and state (if allowed)
    - error=access_denied and state (if denied)

Flow:
    1. Parse form data (auth_context_id, action)
    2. Retrieve authorization context from Redis
    3. Delete context (single-use)
    4. If denied: redirect with error=access_denied
    5. If allowed: generate authorization code, store in DB, redirect with code

Security Notes:
    - Authorization context is single-use (deleted after retrieval)
    - Authorization code is single-use (128 characters, cryptographically random)
    - Code expires after 10 minutes
    - PKCE challenge stored for later verification

Example Redirect (Allow):
    https://example.com/callback?code=abc...&state=xyz

Example Redirect (Deny):
    https://example.com/callback?error=access_denied&state=xyz

## Response `200`

Successful Response

- unknown

---

[API](https://skmtc.net/priority-guard/apis/priority-guardian.md) · [All operations](https://skmtc.net/priority-guard/apis/priority-guardian/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/priority-guard/priority-guardian/versions/8579218b716d/schema)