/oauth/authorize

Submit login, consent, or signup

Browser form submission to the existing authorization endpoint. Send `application/x-www-form-urlencoded`, not JSON, using the csrf_token from the GET form for the same client_id and code_challenge. Keep the authorization parameters in the URL query only; do not duplicate them in the body. The examples show the wire format: replace the illustrative client, PKCE, state, credentials and csrf_token values with those from the current browser connection flow. `consent=allow` authenticates the user and redirects with a one-time code, state, and exact authorization-server issuer in iss (302). `consent=deny` redirects with error=access_denied, state, and iss (302). `consent=signup` creates an unverified account and returns an HTML check-email page (200); it does not issue an authorization code. Invalid session protection or signup input returns HTML (400); failed password/account checks return HTML (401). After client and callback validation, protocol errors redirect safely with error, state, and iss; unknown clients or unregistered callbacks return a local JSON error and are never redirected. This browser connection route is not an MCP tool or generated CLI command.

free

Parameters

Name	In	Required	Default	Allowed	Description	Example
response_type	query	required	—	—	Must be `code`.	code
client_id	query	required	—	—	Registered client id, or an explicitly trusted HTTPS Client ID Metadata Document URL.	cursor
redirect_uri	query	required	—	—	Must match a registered redirect (loopback any-port allowed).	http://127.0.0.1:51000/callback
scope	query	optional	mcp	—	Single `mcp` scope.	mcp
state	query	required	—	—	CSRF/correlation value echoed back.	xyz
code_challenge	query	required	—	—	PKCE S256 challenge (base64url SHA-256 of the verifier).	E2okHPeE...
code_challenge_method	query	required	—	—	Must be `S256` (plain is rejected).	S256
csrf_token	body	required	—	—	Signed form token issued by GET for this client and PKCE challenge.	<csrf_token from GET form>
consent	body	required	—	—	The clicked submit control: allow, deny, or signup. Enter selects Allow.	allow
email	body	optional	—	—	FinRadar account email; required for Allow or signup, not for Deny.	user@example.com
password	body	optional	—	—	Account password; required for Allow or signup, not for Deny.	<account password>

Response schema

Field	Type	Nullable	Description
(POST → signup) HTML check-email page	text/html	no	HTTP 200 confirms the verification step is required. No authorization code is issued.
(POST → Allow) redirect: code	string	no	On successful login + Allow, the endpoint issues a 302 redirect to the registered `redirect_uri` with a one-time authorization `code` in the query string. The client exchanges it at `/oauth/token`.
(POST → Allow) redirect: state	string	no	The `state` value from the request, echoed back on the redirect query string for CSRF/correlation. On Deny, the redirect carries `error=access_denied` (and `state`) instead of a code.

Errors

Status	Label	Description
302		Location points to the registered callback with code, state, and iss after Allow; error=access_denied, state, and iss after Deny; or a protocol error, state, and iss after a safely redirectable request error.
400		HTML form error for invalid CSRF or signup input; local JSON error with no redirect for an unknown client or unregistered callback.
401		HTML login page with an error after failed password/account checks; no authorization code or redirect.

Code samples

Reveal credentials

curl -X POST "https://api.finradar.ai/oauth/authorize?response_type=code&client_id=cursor&redirect_uri=http%3A%2F%2F127.0.0.1%3A51000%2Fcallback&scope=mcp&state=xyz&code_challenge=E2okHPeE...&code_challenge_method=S256" \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d 'csrf_token=%3Ccsrf_token+from+GET+form%3E&consent=allow&email=user%40example.com&password=%3Caccount+password%3E'

Generate an API key in /account/credentials to run live queries (literal YOUR_API_KEY placeholder shown until then).