StudioHomepage
ServicesAuthenticationHTTP APIAuthorization server

Start an authorization

GET
/oauth/authorize

The authorization endpoint (RFC 6749 §4.1.1). Send the user's browser here to sign in. The server requires PKCE with S256 (RFC 7636). After sign-in, the server redirects the browser to redirect_uri with a code, state and iss (RFC 9207). Exchange the code at the token endpoint. A first-party application gets its code without a consent page. A third-party application must ask for at least one Spiral scope and one protected resource (RFC 8707), and the user must give consent. It may also name resources that its registration admits it to, such as ScanDAL; consent does not cover those. If client_id or redirect_uri is missing or not registered, the server does not redirect (RFC 6749 §4.1.2.1). Other errors redirect to redirect_uri with error, error_description, state and iss.

Query Parameters

response_type*string

Must be code (RFC 6749 §4.1.1).

client_id*string

The client ID. For a third-party application, this can be the URL of its Client ID Metadata Document.

redirect_uri*string

A redirect URI registered for the client, compared exactly. First-party HTTP loopback IP callbacks may vary their port (RFC 8252 §7.3). Code redemption must use the complete redirect URI from the authorization request.

Formaturi
state?string

An opaque value that the server returns to redirect_uri. At most 1024 bytes.

Lengthlength <= 1024
code_challenge*string

The PKCE code challenge (RFC 7636 §4.2).

code_challenge_method*string

Must be S256 (RFC 7636 §4.3).

scope?string

Space-separated scopes (RFC 6749 §3.3). Third-party applications must ask for at least one Spiral scope, such as projects:read, and can add openid, profile and email. First-party applications do not send scopes.

resource?string

A resource that the token is for (RFC 8707 §2); repeat it to name several. Third-party applications must send one allowed protected Spiral resource, and may add resources that their registration admits them to.

Formaturi
organization_id?string

An extension parameter. Select one of the user's Organizations for sign-in.

login_hint?string

A hint for the sign-in identifier, such as an email address (OpenID Connect Core §3.1.2.1).

nonce?string

A value that the ID token returns (OpenID Connect Core §3.1.2.1). At most 255 bytes.

Lengthlength <= 255
prompt?string

Space-separated values from none, login, consent and select_account (OpenID Connect Core §3.1.2.1). The server always shows a page, so none returns the error login_required, or consent_required for a client that needs consent.

max_age?string

The maximum age, in seconds, of the user's last sign-in (OpenID Connect Core §3.1.2.1).

Match^[0-9]+$

Response Body

A redirect. It sends the browser to sign in or to the consent page, or back to redirect_uri with the result. A success has code, state and iss. An error has error, error_description, state and iss (RFC 6749 §4.1.2, RFC 9207). First-party applications get status 302. Third-party applications get status 303.

curl -X GET 'https://auth.spiraldb.com/oauth/authorize?response_type=code&client_id=string&redirect_uri=http%3A%2F%2Fexample.com&code_challenge=string&code_challenge_method=S256'
Empty