/oauth/authorizeAuthorize — server-rendered login + consent page
OAuth 2.1 authorization endpoint. GET renders an HTML login + consent page (PKCE S256 required; CSRF-protected; framebusting), not JSON. The user completes this form in a browser. Allow is the first submit button: Enter in the password field attempts authorization through the same password and account checks as clicking Allow. Clicking Deny still refuses access. The form submits to POST on the same URL, retaining the authorization query parameters. Loopback `redirect_uri` (http://127.0.0.1:<any-port>/...) is allowed for native clients (RFC 8252). This browser connection route is not an MCP tool or generated CLI command.
free
Parameters
| Name | In | Required | Default | Allowed | Description | Example |
|---|---|---|---|---|---|---|
| response_type | query | required | — | — | Must be `code`. | code |
| client_id | query | required | — | — | Registered client id, or an explicitly trusted HTTPS Client ID Metadata Document URL. | cursor |
| redirect_uri | query | required | — | — | Must match a registered redirect (loopback any-port allowed). | http://127.0.0.1:51000/callback |
| scope | query | optional | mcp | — | Single `mcp` scope. | mcp |
| state | query | required | — | — | CSRF/correlation value echoed back. | xyz |
| code_challenge | query | required | — | — | PKCE S256 challenge (base64url SHA-256 of the verifier). | E2okHPeE... |
| code_challenge_method | query | required | — | — | Must be `S256` (plain is rejected). | S256 |
Response schema
| Field | Type | Nullable | Description |
|---|---|---|---|
| (GET) HTML login + consent page | text/html | no | GET returns a server-rendered HTML page (HTTP 200) — an interactive login + consent form (framebusted, CSRF-protected). It is NOT a JSON body: the user completes it in a browser. After the client and callback are validated, a missing PKCE `code_challenge` or a `code_challenge_method` other than S256 redirects to that callback with error, state, and iss. Unknown clients and unregistered callbacks receive a local JSON error and are never redirected. |
Errors
| Status | Label | Description |
|---|---|---|
| 302 | If the client and callback are valid but a protocol parameter is invalid, Location points to that registered callback with error, state, and the exact authorization-server issuer in iss. This includes missing PKCE or a method other than S256. | |
| 400 | An unknown client or unregistered callback is rejected locally with a JSON error and no redirect. |
Code samples
curl "https://api.finradar.ai/oauth/authorize?response_type=code&client_id=cursor&redirect_uri=http%3A%2F%2F127.0.0.1%3A51000%2Fcallback&scope=mcp&state=xyz&code_challenge=E2okHPeE...&code_challenge_method=S256" \
-H "X-API-Key: YOUR_API_KEY"Generate an API key in /account/credentials to run live queries (literal YOUR_API_KEY placeholder shown until then).