{"revision":"9f11a31dd2951db0","language":"en","entry":{"id":"oidc-authorize","kind":"endpoint","group":"oidc","title":"Start a sign-in","method":"GET","path":"/oidc/authorize","paths":[],"summary":"The authorization endpoint. It checks the app and its redirect URI, keeps the request 30 minutes and shows the consent page, where the person's device key signs.","response":"The consent page (HTML). After the signature the browser goes to redirect_uri with code, state and iss.","parameters":[{"name":"response_type","in":"query","required":true,"description":"code."},{"name":"client_id","in":"query","required":true,"description":"The app's client_id."},{"name":"redirect_uri","in":"query","required":true,"description":"Exactly one the app registered (a loopback URI with any port)."},{"name":"scope","in":"query","required":true,"description":"openid, and any of profile veil veil:accounts veil:orgs veil:keys."},{"name":"code_challenge","in":"query","required":true,"description":"BASE64URL(SHA-256(code_verifier)), 43 characters."},{"name":"code_challenge_method","in":"query","required":true,"description":"S256."},{"name":"state","in":"query","required":false,"description":"Up to 1024 characters; returned as is, and its SHA-256 is in the signed consent."},{"name":"nonce","in":"query","required":false,"description":"Up to 512 characters; in the signed consent and in the ID token."},{"name":"prompt","in":"query","required":false,"description":"none, or any of login consent select_account."},{"name":"ui_locales","in":"query","required":false,"description":"it shows the page in Italian."}],"sample":"/oidc/authorize","access":"public","base":"directory","notes":["An unknown app or a redirect URI it did not register is refused on the page and never redirected to. Every other mistake goes back to the app as error= with state and iss.","Errors back at the app: invalid_request, invalid_scope, unsupported_response_type, request_not_supported, request_uri_not_supported, access_denied, login_required, consent_required."],"errors":["400 invalid_request","429 rate_limited","500 internal_error","503 busy"],"related":["sign-in-with-veil"],"sections":[{"kind":"code","language":"shell","code":"curl -fsS 'https://veil.rip/oidc/authorize?response_type=code&client_id=veil_app_0123456789abcdef0123456789abcdef&redirect_uri=https%3A%2F%2Fapp.example.org%2Fcallback&scope=openid%20profile%20veil&state=af0ifjsldkj&nonce=n-0S6_WzA2Mj&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256'"}],"live":false,"responses":[{"status":200,"contentType":"text/html","description":"The consent page (HTML). After the signature the browser goes to redirect_uri with code, state and iss.","fields":[]}],"responseObjects":[],"errorFormat":"html","errorDetails":[{"status":400,"code":"invalid_request","description":"OAuth error: a parameter is missing, given twice or malformed, or the body is not a form.","action":"Read `error_description`, fix the request and send it again.","scope":"endpoint"},{"status":429,"code":"rate_limited","description":"An anonymous, signed-request or API-key allowance was exceeded.","action":"Wait at least `Retry-After` seconds. Share a queue and retry budget across your workers.","scope":"common"},{"status":500,"code":"internal_error","description":"An unexpected server error occurred. Internal details are not returned.","action":"Retry reads with bounded backoff. Check write results before sending a new signed operation.","scope":"common"},{"status":503,"code":"busy","description":"The application has reached a temporary concurrency or database limit.","action":"Wait `Retry-After` seconds and retry with bounded backoff.","scope":"common"}],"responseHeaders":[{"name":"Cache-Control","value":"no-store","description":"The page carries a request id."}],"verify":"At the redirect URI check state, then iss equals https://veil.rip, before you exchange the code.","documentationUrl":"https://veil.rip/docs/oidc-authorize","supportsBrowserFetch":false,"browserMode":"local-or-server"}}