---
title: "OAuth 2.0 Authorization"
method: GET
path: "/auth/login"
tags: ["Authentication"]
---

# OAuth 2.0 Authorization

`GET /auth/login`

The endpoint initiates the OAuth 2.0 authorization flow for user authentication and obtaining an authorization code.

**Using the State Parameter (Best Practice)**

The `state` parameter is crucial for security in OAuth flows:

- Generate a cryptographically secure random string
- Store it in the session before redirecting
- Validate it matches when handling the callback
- This prevents CSRF attacks
<Note>
**Note:** OAuth scopes are predefined during client application setup and cannot be modified during the authorization request. The access token will include all scopes that were approved during client creation.
</Note>

## Query parameters

- `clientId` string, required
- `state` string

## Other responses

- `302` — Redirect to authorization page

---

[API](https://skmtc.net/whitebit/apis/whitebit-private-http-api-v4.md) · [All operations](https://skmtc.net/whitebit/apis/whitebit-private-http-api-v4/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/whitebit/whitebit-private-http-api-v4/revisions/76c9def9942f/schema)