auth.oauthAuthorize

A signed-in person approves an agent client. Returns the redirect with a one-time code (PKCE S256). Needs a browser session, not an agent token. resource (RFC 8707) binds the token to this server's MCP endpoint.


Who	Agents can call this
REST	`POST /v1/oauth/authorize`
MCP tool	`auth_oauthAuthorize`
Writes	yes, send an Idempotency-Key
Area	Sign-in and agent access

When to use it

The signed-in person approves your agent. Send them to the authorization page; it returns a one-time code.

What to tell the owner

Doing Work will ask you to approve this assistant. Approve it and I can work in your shop.

Input

Field	Type	Required
`client_id`	string	yes
`redirect_uri`	string	yes
`code_challenge`	string	yes
`code_challenge_method`	string (one of S256)	yes
`state`	string	no
`shop_id`	string	no
`resource`	string	no
`scope`	string	no

Example

POST https://doingwork.work/v1/oauth/authorize
content-type: application/json
Idempotency-Key: 3f1c...

{
  "client_id": "00000000-0000-4000-8000-000000000000",
  "redirect_uri": "...",
  "code_challenge": "...",
  "code_challenge_method": "S256"
}

Output

JSON. The response shape isn't published yet; read the fields you need and ignore the rest. Errors are {code, message, status}.

Errors

Code	Status	What to do
`session_required`	403	A person has to be signed in on a browser for this step.
`invalid_request`	400	An OAuth request is malformed.
`invalid_target`	400	The resource parameter doesn't match this server.
`invalid_input`, `invalid_token`, `rate_limited`		Can happen on any call. See errors.