Authorize

OAuth 2.0 Authorization Endpoint

User must be logged in (authenticated with Supabase JWT). This endpoint creates an authorization code and returns a redirect URL.

PKCE (Proof Key for Code Exchange) is REQUIRED for all authorization requests.

The frontend consent screen should call this endpoint after the user approves, then redirect the user to the returned redirect_url.

Request Body:

• client_id: The OAuth application's client ID
• redirect_uri: Where to redirect after authorization (must match registered URI)
• scopes: List of permissions (e.g., "EXECUTE_GRAPH READ_GRAPH")
• state: Anti-CSRF token provided by client (will be returned in redirect)
• response_type: Must be "code" (for authorization code flow)
• code_challenge: PKCE code challenge (required)
• code_challenge_method: "S256" (recommended) or "plain"

Returns:

• redirect_url: The URL to redirect the user to (includes authorization code)

Error cases return a redirect_url with error parameters, or raise HTTPException for critical errors (like invalid redirect_uri).