API ReferenceInbound Apps (OAuth)
POST
/oauth2/v1/apps/authorize

Request Body

application/json

response_type?string

RFC 9101 §6.3: when a JAR request parameter is present, response_type and redirect_uri may be omitted from the outer query and carried inside the JWT. The controller validates the resolved values after JAR processing.

scope?string
Lengthlength <= 10000
client_id?string
Lengthlength <= 200
state?string
Lengthlength <= 100000
redirect_uri?string
code_challenge_method?string

PKCE

code_challenge?string
Lengthlength <= 5000
nonce?string
Lengthlength <= 5000
loginHint?string
Lengthlength <= 1000
prompt?string
Lengthlength <= 254
flow?string
Lengthlength <= 254
flow_token?string
Lengthlength <= 254
resource?array<string>
string

RFC 8707 - OAuth 2.0 Resource Indicators

Itemsitems <= 50
project_id?string
tenant?string
Lengthlength <= 100
mcp_server_id?string
Lengthlength <= 100
style?string
Lengthlength <= 254
dpop_jkt?string
Lengthlength <= 1000
request?string
Lengthlength <= 10000
request_uri?string
Lengthlength <= 200
authorization_details?string
Lengthlength <= 8192
dynamic_val?string
Lengthlength <= 5000
bg?string
Lengthlength <= 2048
theme?string
Lengthlength <= 254

Start authorization with a JSON request body (non-browser clients). Same semantics as the GET endpoint.

See Authorization server endpoints.

curl -X POST "https://api.descope.com/oauth2/v1/apps/authorize" \  -H "Content-Type: application/json" \  -d '{}'
{}
export interface Response {}
Was this helpful?

OAuth 2.0 authorize endpoint (GET) GET

Start the authorization code flow for an [Inbound App](/identity-federation/inbound-apps). Redirect the user-agent to this endpoint with `client_id`, `redirect_uri`, `response_type=code`, `scope`, `state`, and PKCE parameters. See [Authorization server endpoints](/identity-federation/inbound-apps/authorization-server) for the full flow.

Inbound App PAR POST

Push authorization parameters to Descope from your server before redirecting the user ([RFC 9126](https://datatracker.ietf.org/doc/html/rfc9126)). Descope returns a single-use `request_uri` to send to the authorize endpoint. See [Pushed Authorization Requests](/identity-federation/inbound-apps/pushed-authorization-requests).