OAuth
Generated HTTP reference for the 4 operations the published OpenAPI document describes under oauth.
OAuth
This page is generated from the published OpenAPI document. It is complete with respect to that document and says nothing about surfaces the document does not describe yet. See what is generated here for what that means.
Base URL: https://api.codespar.dev
Every operation below requires a Bearer token. See Authentication.
GET /oauth/authorize
Consent page (RFC 6749 §4.1.1 authorization request)
Query parameters
| Name | Type | Required | Description |
|---|---|---|---|
client_id | string | yes | — |
code_challenge | string | yes | — |
code_challenge_method | "S256" | yes | — |
redirect_uri | string | yes | — |
response_type | "code" | yes | — |
scope | string | no | Space-separated. Requesting more than the pasted key holds is refused. |
state | string | no | — |
Responses
| Status | Body | Description |
|---|---|---|
200 | — | The consent page. |
400 | — | Rendered as HTML, never redirected. |
Example request
curl -X GET https://api.codespar.dev/oauth/authorize \
-H "Authorization: Bearer $CODESPAR_API_KEY"POST /oauth/authorize
Consent submit — exchanges a pasted API key for an authorization code
Responses
| Status | Body | Description |
|---|---|---|
302 | — | Location: <redirect_uri>?code=…&state=… (RFC 6749 §4.1.2). |
400 | — | Rendered as HTML, never redirected. |
Example request
curl -X POST https://api.codespar.dev/oauth/authorize \
-H "Authorization: Bearer $CODESPAR_API_KEY"POST /oauth/register
Register a client (RFC 7591 dynamic client registration)
Request body
| Field | Type | Required | Description |
|---|---|---|---|
client_name | string | no | Truncated to 256 characters. Rendered on the consent page. |
grant_types | array of string | no | — |
redirect_uris | array of string | yes | Absolute https URIs; http only for loopback hosts. |
response_types | array of string | no | — |
token_endpoint_auth_method | string | no | — |
Responses
| Status | Body | Description |
|---|---|---|
201 | object | Created |
400 | object | invalid_redirect_uri when a URI is missing, relative, or http on a non-loopback host. |
Response 201
| Field | Type | Required | Description |
|---|---|---|---|
client_id | string | yes | — |
client_name | string | no | — |
grant_types | array of string | yes | — |
redirect_uris | array of string | yes | — |
response_types | array of string | yes | — |
token_endpoint_auth_method | "none" | yes | — |
Example response
{
"client_id": "client_0000000000000000",
"redirect_uris": [
"https://example.com/hook"
],
"client_name": "Example",
"token_endpoint_auth_method": "none",
"grant_types": [
"string"
],
"response_types": [
"string"
]
}Example request
curl -X POST https://api.codespar.dev/oauth/register \
-H "Authorization: Bearer $CODESPAR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"redirect_uris": [
"https://example.com/hook"
],
"client_name": "Example",
"token_endpoint_auth_method": "https://example.com/hook",
"grant_types": [
"string"
],
"response_types": [
"string"
]
}'POST /oauth/token
Token endpoint — authorization_code and refresh_token grants
Responses
| Status | Body | Description |
|---|---|---|
200 | object | OK |
400 | object | invalid_grant (code invalid, expired, already used, bound to a different client or redirect_uri, PKCE verification failed, or carrying no recorded scope grant), invalid_request, or unsupported_grant_type. |
Response 200
| Field | Type | Required | Description |
|---|---|---|---|
access_token | string | yes | — |
expires_in | integer | yes | — |
refresh_token | string | yes | — |
scope | string | yes | — |
token_type | "Bearer" | yes | — |
Example response
{
"access_token": "string",
"token_type": "Bearer",
"expires_in": 0,
"refresh_token": "string",
"scope": "string"
}Example request
curl -X POST https://api.codespar.dev/oauth/token \
-H "Authorization: Bearer $CODESPAR_API_KEY"