Authorization endpoint (Authorization Code + PKCE)

Starts the Authorization Code flow with PKCE. Requires a valid session. On success responds with a 302 redirect to the client’s redirect_uri carrying code and state. When there is no valid session (login_required) it redirects (302) to the login page with the original authorize URL in next_url. Other typed OAuth errors do NOT redirect and return an OAuth error body.

Authentication

Api-Keystring

API key of the organization. Always sent together with the Secret-Access header.

Query parameters

response_typeenumRequired

Must be 'code'

Allowed values:

client_idstringRequired

OAuth client identifier

redirect_uristringRequired

Client redirect URI

scopestringOptional

Space-separated scopes

statestringOptional

Opaque client state

code_challengestringOptional

PKCE code challenge

code_challenge_methodenumOptional

PKCE method (S256)

Allowed values:

noncestringOptional

OIDC nonce

Response

Successful Response

Errors

400

Bad Request Error

401

Unauthorized Error

422

Unprocessable Entity Error

$	curl -G https://qa.creha.co/api/v5/rest/auth/oauth2/authorize \
>	-H "Secret-Access: Secret-Access" \
>	-H "Api-Key: <apiKey>" \
>	-d client_id=client_id \
>	-d redirect_uri=redirect_uri \
>	-d response_type=code

Authentication

Headers

Query parameters

Response

Errors