> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.bibleit.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.bibleit.dev/_mcp/server.

# Start registered-client authorization

GET https://bibleit.app/oauth/authorize

Validate exact registered redirect URI and explicit allowlisted scopes before any redirect. Require response_type=code, high-entropy state (16–512 bytes), S256 and a 43-character base64url challenge. Unauthenticated users continue through existing login/onboarding using a five-minute opaque request bound to the eventual browser session. GET always requires explicit consent; no automatic approval. Return errors locally for unknown/untrusted callbacks. Clients must verify state and response iss. A resumed request uses only request, with no other query parameters.

**Response headers:**

- `Cache-Control` (200).
- `Referrer-Policy` (200): Native consent form Origin proof; never sends referrers cross-origin.
- `Pragma` (200).

Reference: https://docs.bibleit.dev/api-reference/o-auth/authorize-o-auth

## Request

### Query parameters

- `response_type` ("code", optional)
- `client_id` (string, optional)
- `redirect_uri` (string, optional)
- `scope` (string, optional) — Space-separated explicit registered personal scopes. No empty scope. offline_access alone is invalid.
- `state` (string, optional)
- `code_challenge` (string, optional)
- `code_challenge_method` ("S256", optional)
- `request` (string, optional)

## Response

### 200

Escaped server-rendered consent/connected-app page. No token is issued by GET.

## Examples

**Response**

```json
"string"
```

**SDK Code**

```python
import requests

url = "https://bibleit.app/oauth/authorize"

response = requests.get(url)

print(response.json())
```

```go
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://bibleit.app/oauth/authorize"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```