OAuthStart an authorization
Back to Sofia

OAuth

Start an authorization

Open it in the browser of the person. An unknown client or unregistered redirect_uri gives a 400; otherwise it redirects to Sofia consent screen.

GEThttps://api.sofia-post.com/api/v1/oauth/authorize

Query parameters

  • response_typestringrequired

    Must be code.

  • client_idstringrequired

    The client_id of the client.

  • redirect_uristringrequired

    A registered redirect address, matched exactly.

  • scopestringrequired

    The requested scopes, separated by a space (offline_access to get a refresh token).

  • statestring

    Returned unchanged on the way back, to protect the client against CSRF.

  • code_challengestringrequired

    PKCE challenge, base64url(SHA-256(code_verifier)), required for every client.

  • code_challenge_methodstringrequired

    Must be S256.

Response

302

Redirects to the consent screen, or sends the error back to redirect_uri.

400

invalid_client: unknown client or unregistered redirect_uri.