GET
/authorize
Authorize
Summary
Starts the OAuth 2.0 authorization code + PKCE (S256) flow for Sign in with PESU. Validates the client and redirect URI, then redirects the browser to hosted login (and consent when needed).
Auth
Browser redirect (end-user). No client secret on this request.
Parameters
| Name | In | Required | Type | Description |
|---|---|---|---|---|
response_type |
query | yes | string | Must be `code`. |
client_id |
query | yes | string | Registered client identifier. |
redirect_uri |
query | yes | string | Exact match to a registered redirect URI. |
scope |
query | yes | string | Space-delimited; must include `openid` after filtering known scopes. |
code_challenge |
query | yes | string | BASE64URL (no padding) S256 challenge. |
code_challenge_method |
query | yes | string | Must be `S256`. |
state |
query | no | string | Opaque CSRF value; returned on redirect. |
nonce |
query | no | string | Bound into the ID token when present. |
Example request
GET /authorize?response_type=code&client_id=CLIENT_ID
&redirect_uri=https%3A%2F%2Fapp.example%2Fcallback
&scope=openid%20profile%20email&state=xyz
&code_challenge=CHALLENGE&code_challenge_method=S256 HTTP/1.1
Host: <issuer-host>Success
302 to /login with an HttpOnly session cookie carrying the pending request. After login (and consent if required), the user is redirected to redirect_uri with code and state (if provided).
Errors
| Code | Description |
|---|---|
invalid_client |
Unknown or missing client_id (HTML error page). |
invalid_redirect |
redirect_uri missing or not registered. |
unsupported_response |
Only response_type=code is supported. |
pkce_required |
Missing PKCE or code_challenge_method is not S256. |
invalid_scope |
openid scope required after filtering. |
testing_gate |
Client in Testing: only the developer and invited testers may sign in. |
Notes
- PKCE S256 is mandatory for all clients.
- Clients in Testing may only sign in the developer and invited testers until Production approval.
- Identity-only scopes in this MVP (no public vault or token-exchange APIs).