# Authorize When authenticating a user for a WorkOS Connect application, this is the endpoint they should be redirected to. If they're not already logged in, the user will be redirected to the AuthKit login page. For a third-party application, AuthKit prompts the user to authorize access to the application the first time they use it, and again if the application requests new scopes or organization access. Existing consent skips the consent screen when requested scopes are the same as, or a subset of, scopes previously granted. #### Request #### Response ### GET /oauth2/authorize #### Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `client_id` | string | Yes | The client ID of the WorkOS Connect Application. | | `nonce` | string | Yes | A random string generated by the client that is used to mitigate replay attacks. | | `redirect_uri` | string | Yes | The URL to redirect the user to after they have logged in. | | `response_type` | "code" | Yes | The type of authentication flow. Currently, the only supported value is `"code"`. | | `scope` | string | Yes | A space-separated list of scopes being requested. Acceptable values: `openid`: Required to enable other scopes like `profile` and `email`. `profile`: Adds profile information (name fields) to the ID token. `name` `given_name` `family_name` `email`: Adds email information to the ID token. `email` `email_verified` `offline_access`: Adds a refresh token to the response. | | `state` | string | No | An opaque string used by the client to maintain state between the request and callback. | | `code_challenge` | string | No | A code challenge used for PKCE (Proof Key for Code Exchange). This should be a cryptographically random string, encoded using the given `code_challenge_method`. **Note:** PKCE is only supported by applications created through Dynamic Client Registration, which is required to use MCP (Model Context Protocol) authorization. For setup instructions, see our [MCP guide](/authkit/mcp). | | `code_challenge_method` | "S256" | No | The method used to encode the `code_challenge`. Currently, only `S256` is supported, which means the `code_challenge` is a Base64url-encoded SHA256 hash of the `code_verifier`. | #### Returns | Field | Type | Description | | --- | --- | --- | | `url` | string | The OAuth 2.0 authorization URL to redirect the user to. |