> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bibleit.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bibleit.dev/_mcp/server.

# MCP: Start registered-client authorization

GET https://bibleit.app/oauth/mcp/authorize

Validate exact registered redirect URI and explicit allowlisted scopes before any redirect. Require response_type=code, high-entropy state (16–512 bytes), S256 and a 43-character base64url challenge. Unauthenticated users continue through existing login/onboarding using a five-minute opaque request bound to the eventual browser session. GET always requires explicit consent; no automatic approval. Return errors locally for unknown/untrusted callbacks. Clients must verify state and response iss. A resumed request uses only request, with no other query parameters.

**Response headers:**

- `Cache-Control` (200).
- `Referrer-Policy` (200): Native consent form Origin proof; never sends referrers cross-origin.
- `Pragma` (200).

MCP accepts the configured resource URI for identity.read, offline_access, translation.list, translation.get, translation.read, translation.search, live.list and live.get. Registered client scopes, current actor permissions and explicit fresh consent bound each grant; existing grants cannot gain scopes through refresh. Exact fixed-port localhost HTTP callbacks are supported alongside literal loopback addresses. Uses the dedicated MCP issuer `https://bibleit.app/oauth/mcp`. Existing REST OAuth endpoints and error contracts remain unchanged.

Reference: https://docs.bibleit.dev/api-reference/o-auth/authorize-mcp-o-auth

## Request

### Query parameters

- `response_type` ("code", optional)
- `client_id` (string, optional)
- `redirect_uri` (string, optional)
- `scope` (string, optional) — Space-separated explicit registered personal scopes. No empty scope. offline_access alone is invalid.
- `state` (string, optional)
- `code_challenge` (string, optional)
- `code_challenge_method` ("S256", optional)
- `request` (string, optional)
- `resource` (string, optional) — Optional MCP resource indicator. Must equal the configured MCP resource URI and remain identical at code and refresh exchange. Omit for existing REST-only grants. MCP permits identity.read, offline_access and the read-only scopes advertised by its issuer metadata. Newly requested scopes require client approval and fresh user consent; existing grants are never widened automatically.
- `prompt` ("consent", optional) — Optional explicit consent request, used by Claude Code. Silent authorization is not supported.
- `ui_locales` (string, optional) — Optional bounded space-separated language tags, as sent by ChatGPT. Advisory only; consent currently retains its existing language.

## Response

### 200

Escaped server-rendered consent/connected-app page. No token is issued by GET.

## Examples

**Response**

```json
"string"
```

**SDK Code**

```python
import requests

url = "https://bibleit.app/oauth/mcp/authorize"

response = requests.get(url)

print(response.json())
```

```go
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://bibleit.app/oauth/mcp/authorize"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```