---
title: Authorization request
description: Build an OAuth authorization URL with PKCE, scopes, and state.
---

<ApiEndpoint method="GET" path="/oauth/authorize" />

Send the user’s browser to `https://app.zorveus.com/oauth/authorize` with these query parameters:

<ParamField name="response_type" type="string" required>Use `code`.</ParamField>
<ParamField name="client_id" type="string" required>Use the registered app client ID.</ParamField>
<ParamField name="redirect_uri" type="string" required>Use an exact registered redirect URI.</ParamField>
<ParamField name="scope" type="string" required>Provide space-separated scopes, including `inference:write` and at least one `models:` scope.</ParamField>
<ParamField name="code_challenge" type="string" required>Provide the base64url-encoded SHA-256 digest of the PKCE verifier.</ParamField>
<ParamField name="code_challenge_method" type="string" required>Use `S256`.</ParamField>
<ParamField name="state" type="string">Provide a high-entropy value and verify it when the browser returns. Although the API permits omission, clients should use it for CSRF protection.</ParamField>

```text
https://app.zorveus.com/oauth/authorize?response_type=code&client_id=zrv_client_your_client_id&redirect_uri=https%3A%2F%2Fexample.com%2Fcallback&scope=inference%3Awrite%20models%3A*&code_challenge=YOUR_BASE64URL_CHALLENGE&code_challenge_method=S256&state=YOUR_RANDOM_STATE
```

The requested scopes and models must fit the app’s registered policy. Do not put a client secret in this browser URL.