API ReferenceInbound Apps (OAuth)
POST
/oauth2/v1/apps/par

Request Body

application/json

client_id?string
client_secret?string
response_type?string
scope?string
redirect_uri?string
code_challenge?string
code_challenge_method?string
state?string
nonce?string
dpop_jkt?string
request?string
request_uri?string
project_id?string
client_assertion?string
client_assertion_type?string
ssoAppId?string

Push authorization parameters to Descope from your server before redirecting the user (RFC 9126). Descope returns a single-use request_uri to send to the authorize endpoint.

See Pushed Authorization Requests.

curl -X POST "https://api.descope.com/oauth2/v1/apps/par" \  -H "Content-Type: application/json" \  -d '{}'
{  "request_uri": "string",  "expires_in": 0}
export interface Response {request_uri?: stringexpires_in?: number}
Was this helpful?

OAuth 2.0 authorize endpoint (POST) POST

Start authorization with a JSON request body (non-browser clients). Same semantics as the GET endpoint. See [Authorization server endpoints](/identity-federation/inbound-apps/authorization-server).

OAuth 2.0 token endpoint (Inbound Apps) POST

Exchange authorization codes, refresh tokens, client credentials, JWT bearer assertions, and RFC 8693 token-exchange requests for [Inbound App](/identity-federation/inbound-apps) access tokens. Supported `grant_type` values and examples are documented in [Authorization server endpoints](/identity-federation/inbound-apps/authorization-server) and [Using Inbound Apps](/identity-federation/inbound-apps/using-inbound-apps).