Skip to main content

​
Endpoint

GET /authorize This is the OAuth 2.0 grant that web apps utilize in order to access an API.

​
Responses

​
302

A successful request will redirect the user to the specified callback URL with the access token.

​
Remarks

  • The redirect_uri value must be specified as a valid callback URL under your Application’s Settings.
  • If response_type=token, after the user authenticates with the provider, this will redirect them to your application callback URL while passing the access_token in the address location.hash. This is used for Single-Page Apps and on Native Mobile SDKs.
  • The Implicit Grant does not support the issuance of Refresh Tokens. Use Silent Authentication instead.
  • In order to improve compatibility for applications, Auth0 will now return profile information in a structured claim format as defined by the OIDC specification. This means that in order to add custom claims to ID tokens or Access Tokens, they must conform to a namespaced format to avoid possible collisions with standard OIDC claims.
  • Silent Authentication lets you perform an authentication flow where Auth0 will only reply with redirects, and never with a login page. When an Access Token has expired, silent authentication can be used to retrieve a new one without user interaction, assuming the user’s Single Sign-on (SSO) session has not expired.

​
Learn More

​
Query Parameters

​
string
The unique identifier of the target API you want to access.
​
string
The identifier of the target API (resource server) you want to access. Must match an API Identifier registered in your Auth0 tenant. Used as an alternative to audience when the tenant’s Resource Parameter Compatibility Profile is set to compatibility.
​
string
The scopes which you want to request authorization for. These must be separated by a space.
​
string
required
This will specify the type of token you will receive at the end of the flow. Use token to get only an Access Token, id_token to get only an ID token, or id_token token to get both.Allowed values: token, id_token, id_token token
​
string
required
Your application’s ID.
​
string
An opaque value to prevent CSRF attacks.
​
string
The URL to which Auth0 will redirect the browser after authorization.
​
string
A string value included in the ID token response to prevent token replay attacks.
​
string
The name of the connection configured for your application.
​
string
To initiate a silent authentication request, use prompt=none.
​
string
ID of the organization to use when authenticating a user.
​
string
Ticket ID of the organization invitation.

​
Response Messages