Start registered-client authorization

Validate exact registered redirect URI and explicit allowlisted scopes before any redirect. Require response_type=code, high-entropy state (16–512 bytes), S256 and a 43-character base64url challenge. Unauthenticated users continue through existing login/onboarding using a five-minute opaque request bound to the eventual browser session. GET always requires explicit consent; no automatic approval. Return errors locally for unknown/untrusted callbacks. Clients must verify state and response iss. A resumed request uses only request, with no other query parameters.

Response headers:

Cache-Control (200).
Referrer-Policy (200): Native consent form Origin proof; never sends referrers cross-origin.
Pragma (200).

Query parameters

response_type"code"Optional

client_idstringOptional

redirect_uristringOptionalformat: "uri"

scopestringOptional1-512 characters

Space-separated explicit registered personal scopes. No empty scope. offline_access alone is invalid.

statestringOptional16-512 characters

code_challengestringOptionalformat: "^[a-zA-Z0-9_-]{43}$"

code_challenge_method"S256"Optional

requeststringOptionalformat: "^[a-f0-9]{64}$"

Response headers

Cache-Control"no-store"Optional

Referrer-Policy"same-origin"Optional

Native consent form Origin proof; never sends referrers cross-origin.

Pragma"no-cache"Optional

Response

Escaped server-rendered consent/connected-app page. No token is issued by GET.