1. Docs
  2. API Reference
  3. OAuth2 authorization endpoint

OAuth2 authorization endpoint

GET/oauth/authorize

OAuth2/OIDC authorization endpoint (GET /oauth/authorize). Validates client_id, redirect_uri, response_type (code only), and code_challenge_method (S256 only) against the client's registered values, then serves the hosted login page bound to the client's Environment. When the Environment has a default end-user SSO connection the browser is redirected straight to the IdP; ?method=code opens the emailed-code view, and ?method=sso the single sign-on step; an email-address login_hint (OIDC) fills in the email field. Returns 400 with the "Something's wrong with this sign-in link" page on parameters whose error cannot go back to the client.

Query Parameters

client_idstring Required
redirect_uristring Required
response_typestring Required
scopestring Required
statestring Required
code_challengestring Required
code_challenge_methodstring Required
noncestring Required
methodstring Required
organizationstring Required
login_hintstring Required

Responses

text/html

string

A redirect: to the login URL of the client's default end-user SSO connection; to the client's `redirect_uri` with `code` and `state` when the browser's hosted session resumes into the requested organization; or to the client's `redirect_uri` with `error` and `state` when a verified client's request is refused (an unsupported `response_type`, `code_challenge_method` or scope, a client whose `grant_types` lacks `authorization_code`, a malformed `organization`, or an organization the signed-in person does not belong to)

application/json

  • errorApiErrorBodyDto*

text/html

string
Request
curl -X GET "https://auth.canopy-io.com/oauth/authorize?client_id=value&redirect_uri=value&response_type=value&scope=value&state=value&code_challenge=value&code_challenge_method=value&nonce=value&method=value&organization=value&login_hint=value"
Response
Content-Type: text/html

<!doctype html>
<html lang="en">
  <head>…</head>
  <body>
    <!-- The hosted page: its form, any error, and the Environment's branding -->
  </body>
</html>
 Related endpoints Was this page helpful?

Tell us how we can improve this guide.

Canopy