Skip to main content
GET
cURL

Query Parameters

client_id
string
required

Your app's client ID. Must be registered for OAuth V2.

redirect_uri
string
required

Must match a URI registered on your app. Matching is exact, with two relaxations: loopback hosts (127.0.0.1, ::1, localhost) ignore the port, and apps registered as Mobile, desktop & browser apps may use a registered *.local host if the ports match. A fragment is always rejected. A registered https://app/cb does not match a requested https://app/cb?x=1 -- query strings only work via exact match.

response_type
enum<string>

Always code. Required by RFC 6749 section 4.1.1 and sent automatically by every conformant OAuth library. Simkl does not currently reject a request that omits it, but send it anyway -- it is the only value the authorization endpoint supports, and relying on the omission being tolerated is not something to build on.

Available options:
code
code_challenge
string
required

base64url SHA-256 of your code_verifier, no padding.

code_challenge_method
enum<string>
required

Must be S256. plain is rejected.

Available options:
S256
scope
enum<string>

Space-separated scopes. Omitting this grants media:read only, so an app that writes must ask for media:write explicitly. An unrecognised scope string is silently treated as read-only rather than rejected, so a typo costs you write access with no error. Always check the scope in the token response.

Available options:
media:read,
media:read media:write
state
string

Opaque CSRF value, echoed back byte-for-byte. Generate one per flow, store it, and reject the callback if it does not match.

Response

Redirect to your redirect_uri, carrying either code (plus state and iss) or error.