The authorize endpoint can be used to request tokens or authorization codes via the browser.<\/p>\n\n\n\n
This process typically involves authentication of the end-user and optionally consent.<\/p>\n\n\n\n
identifier of the client.<\/p>\n\n\n\n
one or more registered scopes, delimited with space (required)<\/p>\n\n\n\n
\u25cf id_token requests an identity token (only identity scopes are allowed)<\/p>\n\n\n\n
\u25cf token requests an access token (only resource scopes are allowed)<\/p>\n\n\n\n
\u25cf id_token token requests an identity token and an access token<\/p>\n\n\n\n
\u25cf code requests an authorization code<\/p>\n\n\n\n
\u25cf code id_token requests an authorization code and identity token<\/p>\n\n\n\n
\u25cf code id_token token requests an authorization code, identity token and access token<\/p>\n\n\n\n
\u25cf form_post sends the token response as a form post instead of a fragment encoded redirect (optional)<\/p>\n\n\n\n
\u25cf query sends the token response as a fragment encoded redirect (default)<\/p>\n\n\n\n
\u25cf none no UI will be shown during the request. If this is not possible (e.g. because the user has to sign in or consent) an error is returned<\/p>\n\n\n\n
\u25cf login the login UI will be shown, even if the user is already signed-in and has a valid session<\/p>\n\n\n\n
must exactly match one of the allowed redirect URIs for that client (required)<\/p>\n\n\n\n
Authentication service will echo back the state value on the token response, this is for the round-tripping state between client and provider, correlating request and response and CSRF\/replay protection. (recommended)<\/p>\n\n\n\n
Authentication service will echo back the nonce value in the identity token, this is for replay protection) Required for identity tokens via the implicit grant.<\/p>\n\n\n\n
sends the code challenge for PKCE<\/p>\n\n\n\n
\u25cf plain indicates that the challenge is using plain text (not recommended)<\/p>\n\n\n\n
\u25cf S256 indicates the challenge is hashed with SHA256<\/p>\n\n\n\n