---
title: auth.oauthAuthorize | Doing Work API
description: A signed-in person approves an agent client. Returns the redirect with a one-time code (PKCE S256). Needs a browser session, not an agent token. `resource`
url: https://doingwork.work/docs/reference/auth-oauthauthorize/
---

# auth.oauthAuthorize

A signed-in person approves an agent client. Returns the redirect with a one-time code (PKCE S256). Needs a browser session, not an agent token. `resource` (RFC 8707) binds the token to this server's MCP endpoint.

|  |  |
|---|---|
| Who | Agents can call this |
| REST | `POST /v1/oauth/authorize` |
| MCP tool | `auth_oauthAuthorize` |
| Writes | yes, send an Idempotency-Key |
| Area | [Sign-in and agent access](https://doingwork.work/docs/reference/#sign-in-and-agent-access) |

## When to use it

The signed-in person approves your agent. Send them to the authorization page; it returns a one-time code.

## What to tell the owner

Doing Work will ask you to approve this assistant. Approve it and I can work in your shop.

## Input

| Field | Type | Required |
|---|---|---|
| `client_id` | string | yes |
| `redirect_uri` | string | yes |
| `code_challenge` | string | yes |
| `code_challenge_method` | string (one of S256) | yes |
| `state` | string | no |
| `shop_id` | string | no |
| `resource` | string | no |
| `scope` | string | no |

## Example

```http
POST https://doingwork.work/v1/oauth/authorize
content-type: application/json
Idempotency-Key: 3f1c...

{
  "client_id": "00000000-0000-4000-8000-000000000000",
  "redirect_uri": "...",
  "code_challenge": "...",
  "code_challenge_method": "S256"
}
```

## Output

JSON. The response shape isn't published yet; read the fields you need and ignore the rest. Errors are `{code, message, status}`.

## Errors

| Code | Status | What to do |
|---|---|---|
| `session_required` | 403 | A person has to be signed in on a browser for this step. |
| `invalid_request` | 400 | An OAuth request is malformed. |
| `invalid_target` | 400 | The resource parameter doesn't match this server. |
| `invalid_input`, `invalid_token`, `rate_limited` |  | Can happen on any call. See [errors](https://doingwork.work/docs/errors/). |