POST/api/auth/session/generate-authorization-codeAuthenticated

Issue an authorization code for the current session

Mints a PKCE authorization code for client_app_id on behalf of the signed-in user without re-entering credentials (the OAuth2 authorize bridge and the consent screen use it once the user has authorized the app). The code is bound to the code challenge, the redirect_uri, the granted scopes (with the API scopes of the API server named by resource) and the nonce exactly as a fresh login would bind them. Like a fresh login, a code for a third-party app is refused (403, error_id: email_verification_required) while the account's e-mail address is not verified and the require_email_verification_for_third_party_apps server setting is on.

operationId post_api_auth_session_generate_authorization_codeAuthentication

Authentication & permissionsAuthenticated

Any authenticated user

Accepted credentials
Who may call
Any authenticated user

Request body

Required

application/json
GenerateAuthorizationCodeRequestUnknown keys are rejected.
PropertyTypeDescription
client_app_id*string

Client application the authorization code is issued for

minLength: 2maxLength: 64pattern: ^[a-z0-9_-]*$

code_challenge*string

PKCE S256 code challenge (RFC 7636) the authorization code is bound to

minLength: 43maxLength: 1024

code_challenge_method*"S256"
challenge_time*number

Unix epoch milliseconds when the PKCE verifier was created; expired challenges are refused

minimum: 0

redirect_uristring (uri) | null (uri) | null

OAuth2 redirect_uri bound to the authorization code. Required for third-party client apps and must be registered for the app; omitted (or null) only when the auth server itself is the requesting app.

noncestring | null | null

OIDC login nonce (OIDC Core §3.1.2.1), echoed in the id_token at redemption. Optional.

minLength: 1maxLength: 512pattern: ^[\x20-\x7E]+$

scopestring

Requested scopes, space delimited (RFC 6749 §3.3). The server re-derives the granted subset; absent, or naming no supported scope, is a plain OAuth 2.1 grant without an id_token.

minLength: 1maxLength: 1024pattern: ^[\x21\x23-\x5B\x5D-\x7E]+(?: [\x21\x23-\x5B\x5D-\x7E]+)*$

resourcestring

RFC 8707 resource indicator of the authorization request: an API server id, or the URL of one of its registered domains. When it names an API server this client app may use, the requested scope values that API server defines (its API scopes) are granted too, bound to it. Otherwise it is ignored.

minLength: 1maxLength: 2048

JSONExample
"client_app_id""my-web-app"
"code_challenge""string"
"code_challenge_method""S256"
"challenge_time"1.5
"redirect_uri""https://example.com"
"nonce""string"
"scope""openid profile email"
"resource""https://api.example.com/mcp"

Responses

application/json
GenerateAuthorizationCodeResponse
PropertyTypeDescription
success*true
authorization_code*string

Redeem at POST /api/oidc/token with the PKCE verifier

JSONExample
"success"true
"authorization_code""string"

Example request

bashcurl
curl -X POST 'https://auth.schemavaults.com/api/auth/session/generate-authorization-code' \
  -b 'refresh_token_<auth_server_app_id>=<value>' \
  -H 'Content-Type: application/json' \
  -d '{
  "client_app_id": "my-web-app",
  "code_challenge": "string",
  "code_challenge_method": "S256",
  "challenge_time": 1.5,
  "redirect_uri": "https://example.com",
  "nonce": "string",
  "scope": "openid profile email",
  "resource": "https://api.example.com/mcp"
}'
POST /api/auth/session/generate-authorization-code | SchemaVaults Auth API