System

OAuth2 authorization endpoint (authorization code + PKCE)

GET/oauth/authorize
No scope required

Starts the OAuth2 authorization code flow for a dynamically registered client (see POST /oauth/register). On success the user is redirected to the platform sign-in page and, after consent, back to redirect_uri with code and state. Errors that can be attributed to a registered client are returned as a redirect carrying error and error_description; errors about the client itself are returned as JSON. Requires code_challenge with code_challenge_method=S256.

This endpoint is unauthenticated and carries no scope.

Query parameters

  • response_typestringRequired#
    One of: code
  • client_idstringRequired#
  • redirect_uristring (uri)Required#
  • code_challengestringRequired#
  • code_challenge_methodstringRequired#
    One of: S256
  • scopestringRequired#

    Space-delimited scopes.

  • statestring#

Responses

302

Redirect to the sign-in page, or back to redirect_uri with an OAuth2 error.

400

invalid_request or invalid_client, as an OAuth2 JSON error.

OAuthError

Examples

curl https://your-org-domain/kong/core/api/v2/oauth/authorize?response_type={response_type}&client_id={client_id}&redirect_uri={redirect_uri}&code_challenge={code_challenge}&code_challenge_method={code_challenge_method}&scope={scope}\
  -H "Authorization: Bearer $HELM_API_KEY"\
  -H "Content-Type: application/json"