Authorize Endpoint

OAuth 2.1 authorization endpoint with PKCE.

Validates client, redirect URI, and scopes. Resolves user identity via login_hint parameter, then renders consent screen in user's language.

Query Parameters: response_type: Must be "code" client_id: Registered OAuth client ID redirect_uri: Must match client's registered URIs code_challenge: PKCE code challenge (SHA256) code_challenge_method: Must be "S256" scope: Space-separated scopes (focused.read, focused.write, focused.notify) state: Optional CSRF token nonce: Optional OpenID Connect nonce login_hint: Optional - ChatGPT user ID for user identification resource: Optional - MCP server URL for JWT aud claim (RFC 9728 B2-5)

Returns: HTML consent screen on success Error redirect on validation failure

Security Notes: - login_hint is optional; if missing, an anonymous user is created - User identity resolved via login_hint → core_users.chatgpt_user_id - Never accept raw user_id from query params (prevents impersonation) - PKCE required (S256 challenge method) - redirect_uri must be pre-registered - Rate limited: by IP always, by login_hint if provided - Authorization context stores internal user_id (UUID), NOT chatgpt_user_id

Example: GET /oauth/focused/authorize? response_type=code& client_id=focused-client-123& redirect_uri=https://example.com/callback& code_challenge=abc...& code_challenge_method=S256& scope=focused.read+focused.write& state=xyz& login_hint=chatgpt_user_123