Authorization endpoint
curl --request GET \
--url https://prod-auth.tktchurch.com/oauth/authorizeimport Foundation
let url = URL(string: "https://prod-auth.tktchurch.com/oauth/authorize")!
var request = URLRequest(url: url)
request.httpMethod = "GET"
request.timeoutInterval = 10
let (data, _) = try await URLSession.shared.data(for: request)
print(String(decoding: data, as: UTF8.self))const options = {method: 'GET'};
fetch('https://prod-auth.tktchurch.com/oauth/authorize', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://prod-auth.tktchurch.com/oauth/authorize"
response = requests.get(url)
print(response.text){
"error": "invalid_request",
"error_description": "Redirect URI not registered for this client"
}Authorization endpoint
API-first authorization entrypoint. PKCE S256 enforced; redirect_uri must be pre-registered; request_uri replays a PAR. Returns a JSON consent challenge, or 302 when the client sets login_page_url.
GET
/
oauth
/
authorize
Authorization endpoint
curl --request GET \
--url https://prod-auth.tktchurch.com/oauth/authorizeimport Foundation
let url = URL(string: "https://prod-auth.tktchurch.com/oauth/authorize")!
var request = URLRequest(url: url)
request.httpMethod = "GET"
request.timeoutInterval = 10
let (data, _) = try await URLSession.shared.data(for: request)
print(String(decoding: data, as: UTF8.self))const options = {method: 'GET'};
fetch('https://prod-auth.tktchurch.com/oauth/authorize', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://prod-auth.tktchurch.com/oauth/authorize"
response = requests.get(url)
print(response.text){
"error": "invalid_request",
"error_description": "Redirect URI not registered for this client"
}Query Parameters
e.g. code
Example:
"code"
Public client id
Example:
"dev-console"
Must be pre-registered
Example:
"https://developers.tktchurch.com/callback"
Space-separated scopes
Example:
"openid profile email"
Opaque CSRF value
S256 challenge
Must be S256 — plain is rejected
Example:
"S256"
OIDC nonce
PAR replay
RFC 8707 resource indicator
Response
JSON consent challenge, or 302 redirect to the login page
