> ## Documentation Index
> Fetch the complete documentation index at: https://www.posted.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Begin MCP OAuth authorization

> Validates the client, exact redirect URI, MCP resource and S256 PKCE challenge, then redirects to Posted's human consent flow. The human chooses the access level.

No signed-in session is required. Endpoint-specific tokens, setup secrets or challenges may still be required.

Validates the client, exact redirect URI, MCP resource and S256 PKCE challenge, then redirects to Posted's human consent flow. The human chooses the access level.

[Request conventions](/api-reference/overview) · [API keys](/api-keys) · [MCP connections](/mcp-connections)


## OpenAPI

````yaml api-reference/openapi.json GET /oauth/authorize
openapi: 3.1.0
info:
  title: Posted HTTP API
  version: 0.2.0
  description: >-
    All registered application, account, OAuth, MCP transport and health
    endpoints. Publishing and draft request schemas come from the shared runtime
    validators. Replace the example server with your installation. Documentation
    uses simple request examples and does not execute live publishing requests.
servers:
  - url: https://posted-api.example.com
security: []
paths:
  /oauth/authorize:
    get:
      tags:
        - OAuth and MCP transport
      summary: Begin MCP OAuth authorization
      description: >-
        Validates the client, exact redirect URI, MCP resource and S256 PKCE
        challenge, then redirects to Posted's human consent flow. The human
        chooses the access level.


        No signed-in session is required. Endpoint-specific tokens, setup
        secrets or challenges may still be required.
      operationId: get_oauth_authorize
      parameters:
        - name: response_type
          in: query
          required: true
          schema:
            type: string
            const: code
          description: string
        - name: client_id
          in: query
          required: true
          schema:
            type: string
          description: string
        - name: redirect_uri
          in: query
          required: true
          schema:
            type: string
            format: uri
          description: uri
        - name: code_challenge
          in: query
          required: true
          schema:
            type: string
          description: string
        - name: code_challenge_method
          in: query
          required: true
          schema:
            type: string
            const: S256
          description: string
        - name: resource
          in: query
          required: true
          schema:
            type: string
            format: uri
          description: uri
        - name: state
          in: query
          required: false
          schema:
            type: string
          description: string
        - name: scope
          in: query
          required: false
          schema:
            type: string
          description: string
      responses:
        '302':
          description: Redirect to the authorization, consent or UI destination.
          headers:
            Location:
              schema:
                type: string
                format: uri
              description: Redirect destination
        default:
          description: >-
            OAuth failure with error and error_description. Consent/session
            authority may also return the standard Posted error envelope.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                  error_description:
                    type: string
      security: []

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.