# Start an authorization (browser redirect)

> Source: https://elaichi.ai/docs/api-reference/mcp-oauth/oauth/startoauthauthorization/

`GET /oauth/authorize`

Resource: **Oauth** · API: **MCP OAuth**

## Query parameters

- **`client_id`** _(string, required)_
  From `POST /oauth/register` (`ocli_…`).
- **`redirect_uri`** _(string, required)_
  Must exactly match one of the URIs registered for this client.
- **`response_type`** _(string, required)_
  Only `code` is supported.
  Allowed: `code`
- **`code_challenge`** _(string, required)_
  PKCE challenge: base64url, 43–128 characters.
- **`code_challenge_method`** _(string, required)_
  Must be `S256`. `plain` and an absent value are both rejected.
  Allowed: `S256`
- **`scope`** _(string)_
  MCP scopes, space-delimited on the wire. `mcp:read` reads org data; `mcp:write` creates and changes it; `mcp:destructive` deletes and removes access; `mcp:tools` invokes the third-party tools the user has connected. `openid` and `email` are identity scopes: they authorize `GET/POST /oauth/userinfo` and grant no MCP access on their own — a grant holding only `openid email` reaches no `mcp:*` operation and no connected tool. Requesting `mcp:write` or `mcp:destructive` implies `mcp:read` — a client that can mutate what it cannot read is not a useful capability. Unknown scope values are rejected rather than silently dropped. A request with no `scope` at all defaults to `mcp:read`.
- **`state`** _(string)_
  Opaque client value, echoed on every redirect back.
- **`resource`** _(string)_
  RFC 8707 audience. Must identify this server by origin; a resource on another origin is an audience-confusion attempt and is rejected with `invalid_target`.

## Code examples

### curl

```bash
curl -X GET 'https://api.elaichi.ai/oauth/authorize' \
  -H 'Content-Type: application/json'
```

### JavaScript

```javascript
const response = await fetch('https://api.elaichi.ai/oauth/authorize', {
  method: 'GET',
  headers: {
    'Content-Type': 'application/json',
  },
});

const data = await response.json();
console.log(data);
```

### Python

```python
import os
import requests

url = "https://api.elaichi.ai/oauth/authorize"
headers = {
    "Content-Type": "application/json",
}

response = requests.get(url, headers=headers)
print(response.json())
```