OAuth authorization endpoint redirect proxy

GET

/oauth/authorize

const url = 'https://example.com/api/oauth/authorize?response_type=code&code_challenge_method=S256';
const options = {method: 'GET'};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request GET \
  --url 'https://example.com/api/oauth/authorize?response_type=code&code_challenge_method=S256'

Redirects to Supabase /auth/v1/oauth/authorize while preserving the original query string. Discovered as authorization_endpoint from /.well-known/oauth-authorization-server so clients keep AppHandoff as the authorization-server issuer and use the AppHandoff token proxy for code exchange and refresh.

Parameters

Query Parameters

client_id

string

OAuth client identifier.

redirect_uri

string format: uri

Client callback URI registered with the OAuth client.

response_type

string

Allowed values: code

OAuth response type.

code_challenge

string

PKCE S256 code challenge.

code_challenge_method

string

Allowed values: S256

PKCE challenge method.

state

string

Opaque client state.

scope

string

Space-separated OAuth scopes.

resource

string format: uri

Optional RFC 8707 resource indicator. The canonical value is the /mcp endpoint; the API base URL and legacy /api/mcp-bot endpoint remain accepted as exact transition aliases.

Responses

302

Redirect to Supabase authorization endpoint.

Headers

Location

string format: uri

400

Invalid authorization request. Error codes:

invalid_request — required redirect or client metadata is missing
invalid_client — the CIMD document is rejected or does not authorize the callback
invalid_target — the RFC 8707 resource is not an accepted MCP audience

application/json

object

error

required

string

Allowed values: invalid_request invalid_client invalid_target

error_description

string

503

OAuth server unavailable or CIMD lookup failed (temporarily_unavailable).

application/json

object

error

required

Human-readable error message

string

code

Stable machine-readable error code for client branching

string

fieldErrors

First validation message per field path

object

key

additional properties

string

issues

Structured validation issues (Zod)

Array<object>

object

path

required

string

message

required

string

retryAfter

Seconds until rate limit resets (429 responses)

number