# GET /oauth/authorize

> Request an OAuth authorization code or access token with client_id, response_type, redirect_uri and state; DS Server redirects with 302 and no sign-in page.

- **Product:** DS Server
- **Section:** Documentation
- **Kind:** Endpoint
- **Path:** DS Server > API Reference > Web API > OAuth > /authorize > GET /oauth/authorize
- **854 words**
- **Web URL:** https://docs.textcontrol.com/ds-server/reference/web-api/oauth/authorize/get/
- **LLMs URL:** https://docs.textcontrol.com/ds-server/reference/web-api/oauth/authorize/get/llms.txt
- **LLMs-Full URL:** https://docs.textcontrol.com/ds-server/reference/web-api/oauth/authorize/get/llms-full.txt

---

`GET` `https://example.com/oauth/authorize`

### Description

Requests an authorization code or an access token for a security profile and redirects the browser to the given redirect URI with the result. DS Server doesn't show a sign-in or consent page: when the client ID and the redirect URI are valid, it redirects at once.

With `response_type=code`, the redirect carries an authorization code that [POST /oauth/token](https://docs.textcontrol.com/ds-server/reference/web-api/oauth/token/post/llms-full.txt) exchanges for an access token. With `response_type=token`, it carries the access token itself.

When DS Server can't authorize the request itself, for example because it doesn't know the client ID, it forwards the request to the registered authentication servers (see [GET /authenticationserver/authorize](https://docs.textcontrol.com/ds-server/reference/web-api/authenticationserver/authorize/get/llms-full.txt)).

### Examples

The following sample requests an authorization code using the "code" flow. The authorization code is returned to the given redirect URI.

```bash
# Request:
curl --request GET 'https://trial.dsserver.io/oauth/authorize?redirect_uri=https://localhost:5001/callback&client_id=yourclientid&response_type=code&state=teststate'

# Response:
HTTP/1.1 302 Found
Location: https://localhost:5001/callback?code=g0ZGZmNjVmOWIjNTk2NTk4ZTYyZGI3&state=teststate
```

With `response_type=token`, the access token is returned to the redirect URI instead:

```text
HTTP/1.1 302 Found
Location: https://localhost:5001/callback?access_token=nmZ80Zn2R0P2AbS149E31IUHd5aZgB9T&token_type=Bearer&expires_in=3600&state=teststate
```

### Request Parameters

| Name | Type | Value | Optional |
|---|---|---|---|
| client\_id | String | The client ID of the security profile. | no |
| response\_type | String | The type of the requested response. Supported values are "code" and "token". | no |
| redirect\_uri | String | The redirect URI must match one of the authorized redirect URIs of the security profile. Upper and lower case are ignored; the scheme, host, port, path and query string must be the same. | no |
| state | String | DS Server echoes back the state value in the redirect. | yes |
| scope | String | The scope of the request. | yes |

### Success Response

| Status | Description |
|---|---|
| 302 | On success, the request is redirected to the given redirect URI with the query parameters `code` and `state` ("code") or `access_token`, `token_type`, `expires_in` and `state` ("token"). |

### Error Response

| Status | Description |
|---|---|
| 400 | A 400 (Bad Request) with the plain text (`text/plain`) "Missing, invalid or mismatching redirection URI." is returned, if the redirect URI is missing or is not one of the authorized redirect URIs of the security profile. |
| 302 | Other errors are returned to the redirect URI in the query parameters `error`, `error_description` and `state`: `unauthorized_client` with an empty description for an unknown client ID or when the registered authentication servers reject the request, and `unsupported_response_type` "Unsupported response type." for a response type other than "code" or "token". |
| 302 | Without a client ID or a response type, the `Location` header holds only the query string `?error=invalid_request&error_description=...` with "Missing 'client\_id' parameter." or "Missing 'response\_type' parameter.", without the redirect URI and without `state`. |

---

## Nearby

- **Previous:** [/oauth/authorize](https://docs.textcontrol.com/ds-server/reference/web-api/oauth/authorize/llms-full.txt)
- **Next:** [/oauth/token](https://docs.textcontrol.com/ds-server/reference/web-api/oauth/token/llms-full.txt)