Start the authorization-code flow
GET /oauth/authorize
Redirect the org owner's browser here. PKCE (code_challenge, code_challenge_method=S256) is required for public clients. Only an owner of the company can approve.
Authentication
Unauthenticated at the HTTP layer — this is one of the two OAuth endpoints.
Query parameters
| Name | Required | Description |
|---|---|---|
client_id | Yes | Your registered client ID. |
redirect_uri | Yes | Must match a registered redirect URI. |
scope | Yes | Space-separated list of requested scopes. |
state | No | Opaque value round-tripped back to your redirect URI. Required for partner apps. |
code_challenge | No | PKCE challenge (S256). |
code_challenge_method | No | Always S256 when code_challenge is set. |
Errors
See Errors for the full list of status codes this endpoint can return.
Samples
curl
curl -X GET "https://app.sparro.dk/api/v2/oauth/authorize?client_id=YOUR_CLIENT_ID&redirect_uri=https%3A%2F%2Fexample.com%2Fcallback&scope=invoices%3Aread%20customers%3Aread&code_challenge_method=S256"