OAuth
Generated HTTP reference for the 4 operations the published OpenAPI document describes under oauth.
2 min read
OAuth
This page is generated from the published OpenAPI document. It is complete with respect to that document and says nothing about surfaces the document does not describe yet. See what is generated here for what that means.
Base URL: https://api.codespar.dev
None of the operations below takes a credential: the published document declares them open. See Authentication for the rest of the API.
GET /oauth/authorize
GET
https://api.codespar.dev/oauth/authorizeNo credential
Consent page (RFC 6749 §4.1.1 authorization request)
Query parameters
| Name | Type | Required | Description |
|---|---|---|---|
client_id | string | yes | — |
code_challenge | string | yes | — |
code_challenge_method | "S256" | yes | — |
redirect_uri | string | yes | — |
response_type | "code" | yes | — |
scope | string | no | Space-separated. Requesting more than the pasted key holds is refused. |
state | string | no | — |
Responses
| Status | Body | Description |
|---|---|---|
200 | — | The consent page. |
400 | — | Rendered as HTML, never redirected. |
Example request
curl -X GET https://api.codespar.dev/oauth/authorize \
-H "Authorization: Bearer $CODESPAR_API_KEY"const res = await fetch("https://api.codespar.dev/oauth/authorize", {
method: "GET",
headers: {
Authorization: `Bearer ${process.env.CODESPAR_API_KEY}`,
},
});
const data = await res.json();POST /oauth/authorize
POST
https://api.codespar.dev/oauth/authorizeNo credential
Consent submit — exchanges a pasted API key for an authorization code
Responses
| Status | Body | Description |
|---|---|---|
302 | — | Location: <redirect_uri>?code=…&state=… (RFC 6749 §4.1.2). |
400 | — | Rendered as HTML, never redirected. |
Example request
curl -X POST https://api.codespar.dev/oauth/authorize \
-H "Authorization: Bearer $CODESPAR_API_KEY"const res = await fetch("https://api.codespar.dev/oauth/authorize", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.CODESPAR_API_KEY}`,
},
});
const data = await res.json();POST /oauth/register
POST
https://api.codespar.dev/oauth/registerNo credential
Register a client (RFC 7591 dynamic client registration)
Request body
| Field | Type | Required | Description |
|---|---|---|---|
client_name | string | no | Truncated to 256 characters. Rendered on the consent page. |
grant_types | array of string | no | — |
redirect_uris | array of string | yes | Absolute https URIs; http only for loopback hosts. |
response_types | array of string | no | — |
token_endpoint_auth_method | string | no | — |
Responses
| Status | Body | Description |
|---|---|---|
201 | object | Created |
400 | object | invalid_redirect_uri when a URI is missing, relative, or http on a non-loopback host. |
Response 201
| Field | Type | Required | Description |
|---|---|---|---|
client_id | string | yes | — |
client_name | string | no | — |
grant_types | array of string | yes | — |
redirect_uris | array of string | yes | — |
response_types | array of string | yes | — |
token_endpoint_auth_method | "none" | yes | — |
Example request
curl -X POST https://api.codespar.dev/oauth/register \
-H "Authorization: Bearer $CODESPAR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"redirect_uris": [
"https://example.com/hook"
],
"client_name": "Example",
"token_endpoint_auth_method": "https://example.com/hook",
"grant_types": [
"string"
],
"response_types": [
"string"
]
}'const res = await fetch("https://api.codespar.dev/oauth/register", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.CODESPAR_API_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
"redirect_uris": [
"https://example.com/hook"
],
"client_name": "Example",
"token_endpoint_auth_method": "https://example.com/hook",
"grant_types": [
"string"
],
"response_types": [
"string"
]
}),
});
const data = await res.json();Example response 201
{
"client_id": "client_0000000000000000",
"redirect_uris": [
"https://example.com/hook"
],
"client_name": "Example",
"token_endpoint_auth_method": "none",
"grant_types": [
"string"
],
"response_types": [
"string"
]
}POST /oauth/token
POST
https://api.codespar.dev/oauth/tokenNo credential
Token endpoint — authorization_code and refresh_token grants
Responses
| Status | Body | Description |
|---|---|---|
200 | object | OK |
400 | object | invalid_grant (code invalid, expired, already used, bound to a different client or redirect_uri, PKCE verification failed, or carrying no recorded scope grant), invalid_request, or unsupported_grant_type. |
Response 200
| Field | Type | Required | Description |
|---|---|---|---|
access_token | string | yes | — |
expires_in | integer | yes | — |
refresh_token | string | yes | — |
scope | string | yes | — |
token_type | "Bearer" | yes | — |
Example request
curl -X POST https://api.codespar.dev/oauth/token \
-H "Authorization: Bearer $CODESPAR_API_KEY"const res = await fetch("https://api.codespar.dev/oauth/token", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.CODESPAR_API_KEY}`,
},
});
const data = await res.json();Example response 200
{
"access_token": "string",
"token_type": "Bearer",
"expires_in": 0,
"refresh_token": "string",
"scope": "string"
}