Start the authorization code flow and issue a code

GEThttps://api.testingapis.com/api/auth/oauth/authorizeSign in to see this endpoint's URL

Start the authorization code flow and issue a code (auto-approved as user apibee).

Codes are single use and expire after 10 minutes. Exchange them at POST /api/auth/oauth/token.Codes are single use and expire after 10 minutes. Exchange them at POST ….

Note: PKCE: code_challenge = base64url(SHA-256(code_verifier)). Registered redirect URIs (localhost, 127.0.0.1, Postman, this server's Swagger) get a 302. Any other redirect_uri is refused with 400 invalid_request and no code is issued. Leave redirect_uri out to get the code as JSON.

Parameters 7

Name	Type	Description
`response_type`	query · string	Must be code.
`client_id`	query · string	apibee-client (confidential) or apibee-public (public; PKCE required).
`redirect_uri`	query · string	Where to send the code. Registered: http(s) URIs on localhost or 127.0.0.1 (any port) and the Postman callbacks. Any other value is refused with 400 and no code is issued; leave it out to get the code as JSON.
`scope`	query · string	Space-separated subset of the client's scopes (apibee-client: read write profile email; apibee-public: read profile email). Defaults to all of them.
`state`	query · string	Opaque value echoed back unchanged.
`code_challenge`	query · string	PKCE challenge: BASE64URL(SHA256(code_verifier)) for S256, or the verifier itself for plain.
`code_challenge_method`	query · string	S256 or plain (default plain).

Responses

200: Code returned as JSON (no redirect_uri sent).
302: Redirect to redirect_uri with code and state.
400: invalid_client, unsupported_response_type, invalid_request (including an unregistered redirect_uri) or invalid_scope.

Example

Request

curl -X GET "https://api.testingapis.com/api/auth/oauth/authorize?response_type=code&client_id=apibee-public&redirect_uri=http://localhost:3000/callback&state=xyz&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256" \
  -H "X-TestingApis-Key: YOUR_API_KEY"

Response302 Found

Location: http://localhost:3000/callback?code=code_3d7eac7eaf6981c2de11965a88d969531cf9a9c3&state=xyz

The parameters, request and response examples and the live Try it panel for this endpoint are for signed-in members. Accounts are free and take a few seconds to create.

Try itSign-in requiredUses your key

api.testingapis.com

curl 'https://api.testingapis.com/api/auth/oauth/authorize?response_type=code&client_id=apibee-public&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcallback&state=xyz&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256' \
  -H 'X-TestingApis-Key: YOUR_API_KEY'

const res = await fetch("https://api.testingapis.com/api/auth/oauth/authorize?response_type=code&client_id=apibee-public&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcallback&state=xyz&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256", {
  headers: {
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
});
console.log(res.status, await res.text());

const res = await fetch("https://api.testingapis.com/api/auth/oauth/authorize?response_type=code&client_id=apibee-public&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcallback&state=xyz&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256", {
  headers: {
    "X-TestingApis-Key": "YOUR_API_KEY",
  },
});
const body: string = await res.text();
console.log(res.status, body);

import requests

res = requests.get(
    "https://api.testingapis.com/api/auth/oauth/authorize?response_type=code&client_id=apibee-public&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcallback&state=xyz&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256",
    headers={
        "X-TestingApis-Key": "YOUR_API_KEY",
    },
)
print(res.status_code, res.text)

using var client = new HttpClient();
using var request = new HttpRequestMessage(HttpMethod.Get, "https://api.testingapis.com/api/auth/oauth/authorize?response_type=code&client_id=apibee-public&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcallback&state=xyz&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256");
request.Headers.TryAddWithoutValidation("X-TestingApis-Key", "YOUR_API_KEY");
using var response = await client.SendAsync(request);
Console.WriteLine($"{(int)response.StatusCode} {await response.Content.ReadAsStringAsync()}");

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Main {
    public static void main(String[] args) throws Exception {
        HttpClient client = HttpClient.newHttpClient();
        HttpRequest request = HttpRequest.newBuilder(URI.create("https://api.testingapis.com/api/auth/oauth/authorize?response_type=code&client_id=apibee-public&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcallback&state=xyz&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256"))
                .header("X-TestingApis-Key", "YOUR_API_KEY")
                .GET()
                .build();
        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode() + " " + response.body());
    }
}

package main

import (
	"fmt"
	"io"
	"net/http"
)

func main() {
	req, err := http.NewRequest("GET", "https://api.testingapis.com/api/auth/oauth/authorize?response_type=code&client_id=apibee-public&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcallback&state=xyz&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256", nil)
	if err != nil {
		panic(err)
	}
	req.Header.Set("X-TestingApis-Key", "YOUR_API_KEY")
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		panic(err)
	}
	defer res.Body.Close()
	data, err := io.ReadAll(res.Body)
	if err != nil {
		panic(err)
	}
	fmt.Println(res.StatusCode, string(data))
}

GET

https://api.testingapis.com/api/auth/oauth/authorize?response_type=code&client_id=apibee-public&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcallback&state=xyz&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256

Query

response_typestring

client_idstring

redirect_uristring

scopestring

statestring

code_challengestring

code_challenge_methodstring

Start the authorization code flow and issue a code

Parameters 7

Responses

Example

Related