/oauth/authorizeAuthorize — server-rendered login + consent page
OAuth 2.1 authorization endpoint. GET renders a login + consent page (PKCE S256 required; CSRF-protected; framebusting). POST authenticates the user against the FinRadar login and, on Allow, redirects to `redirect_uri?code=...&state=...`. Loopback `redirect_uri` (http://127.0.0.1:<any-port>/...) is allowed for native clients (RFC 8252).
free
Parameters
| Name | In | Required | Default | Allowed | Description | Example |
|---|---|---|---|---|---|---|
| response_type | query | required | — | — | Must be `code`. | code |
| client_id | query | required | — | — | Registered client id. | cursor |
| redirect_uri | query | required | — | — | Must match a registered redirect (loopback any-port allowed). | http://127.0.0.1:51000/callback |
| scope | query | optional | mcp | — | Single `mcp` scope. | mcp |
| state | query | required | — | — | CSRF/correlation value echoed back. | xyz |
| code_challenge | query | required | — | — | PKCE S256 challenge (base64url SHA-256 of the verifier). | E2okHPeE... |
| code_challenge_method | query | required | — | — | Must be `S256` (plain is rejected). | S256 |
Response schema
| Field | Type | Nullable | Description |
|---|---|---|---|
| (GET) HTML login + consent page | text/html | no | GET returns a server-rendered HTML page (HTTP 200) — an interactive login + consent form (framebusted, CSRF-protected). It is NOT a JSON body: the user completes it in a browser. A request missing PKCE `code_challenge`/`code_challenge_method=S256` returns 400 with `{error, error_description}` instead of the page. |
| (POST → Allow) redirect: code | string | no | On successful login + Allow, the endpoint issues a 302 redirect to the registered `redirect_uri` with a one-time authorization `code` in the query string. The client exchanges it at `/oauth/token`. |
| (POST → Allow) redirect: state | string | no | The `state` value from the request, echoed back on the redirect query string for CSRF/correlation. On Deny, the redirect carries `error=access_denied` (and `state`) instead of a code. |
Errors
| Status | Label | Description |
|---|---|---|
| 200 | OK | Request succeeded. |
| 400 | Bad Request | Invalid query, body, or path parameter. |
| 401 | Unauthorized | Missing or invalid Authorization header / api_Token. |
| 402 | Payment Required | Insufficient token balance for this call. Top up |
| 429 | Too Many Requests | Rate limit exceeded for your tier (see /pricing for tier limits). Tier limits |
| 500 | Server Error | Unexpected server-side failure. Retry with backoff; report if persistent. |
Code samples
curl "https://api.finradar.ai/oauth/authorize?response_type=code&client_id=cursor&redirect_uri=http%3A%2F%2F127.0.0.1%3A51000%2Fcallback&scope=mcp&state=xyz&code_challenge=E2okHPeE...&code_challenge_method=S256" \
-H "Authorization: Bearer YOUR_JWT_TOKEN"Generate an API key in /account/credentials to run live queries (literal YOUR_API_KEY placeholder shown until then).