---
updatedAt: 2026-08-24T09:16:33.000Z
agentTools:
  projectIndex: https://developers.vibe.co/llms.txt
---

# Start the authorization code flow

Authorization endpoint for the OAuth 2.0 Authorization Code flow. The
client redirects the user's browser here; the authorization server
prompts for consent and then redirects back to `redirect_uri` with an
authorization code, which the client exchanges for an access token at
`/oauth2/token`.

This endpoint does not require the `X-Vibe-Revision` header.

The `X-Vibe-Revision` header and the standard Vibe API security schemes do
**not** apply here — authentication is performed by the authorization
server itself against the client registration.


# OpenAPI definition

```json
{
  "openapi": "3.1.0",
  "info": {
    "title": "Vibe Developer Platform API — OAuth",
    "version": "1.0.0",
    "description": "OAuth 2.0 authorization endpoints for the Vibe Developer Platform API.\n\nSupports two grants:\n\n- **Authorization Code** — for apps acting on behalf of a specific Vibe user.\n- **Client Credentials** — for server-to-server integrations acting on their\n  own behalf.\n\nTokens issued here are sent as `Authorization: Bearer <access_token>` on\nsubsequent Vibe API requests. The `X-Vibe-Revision` header required by the\nmain API does **not** apply to these endpoints.\n"
  },
  "servers": [
    {
      "url": "https://api.vibe.co",
      "description": "Production"
    }
  ],
  "tags": [
    {
      "name": "OAuth",
      "description": "OAuth 2.0 authorization and token endpoints.\n"
    }
  ],
  "paths": {
    "/oauth2/auth": {
      "get": {
        "operationId": "oauth2Authorize",
        "tags": [
          "OAuth"
        ],
        "summary": "Start the authorization code flow",
        "description": "Authorization endpoint for the OAuth 2.0 Authorization Code flow. The\nclient redirects the user's browser here; the authorization server\nprompts for consent and then redirects back to `redirect_uri` with an\nauthorization code, which the client exchanges for an access token at\n`/oauth2/token`.\n\nThis endpoint does not require the `X-Vibe-Revision` header.\n\nThe `X-Vibe-Revision` header and the standard Vibe API security schemes do\n**not** apply here — authentication is performed by the authorization\nserver itself against the client registration.\n",
        "security": [],
        "parameters": [
          {
            "name": "client_id",
            "in": "query",
            "required": true,
            "description": "OAuth client identifier assigned at client registration.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "redirect_uri",
            "in": "query",
            "required": true,
            "description": "Callback URI for the authorization response. Must match a URI registered for this client.",
            "schema": {
              "type": "string",
              "format": "uri"
            }
          },
          {
            "name": "response_type",
            "in": "query",
            "required": true,
            "description": "OAuth response type. Only `code` is supported.",
            "schema": {
              "type": "string",
              "enum": [
                "code"
              ]
            }
          },
          {
            "name": "scope",
            "in": "query",
            "required": true,
            "description": "Space-delimited list of requested OAuth scopes.",
            "schema": {
              "type": "string",
              "example": "campaigns:read audiences:write"
            }
          },
          {
            "name": "state",
            "in": "query",
            "required": true,
            "description": "Opaque value generated by the client and echoed back on callback. Used to prevent CSRF — validate it matches what you sent.",
            "schema": {
              "type": "string"
            }
          }
        ],
        "responses": {
          "302": {
            "description": "Redirects to `redirect_uri`. On success the URL carries `code` and\n`state` query parameters. On failure it carries `error`,\n`error_description`, and `state` query parameters per RFC 6749 §4.1.2.1.\n",
            "headers": {
              "Location": {
                "description": "Redirect target with either success (`code`, `state`) or error (`error`, `error_description`, `state`) query parameters.",
                "schema": {
                  "type": "string",
                  "format": "uri"
                }
              }
            }
          },
          "400": {
            "description": "The authorization request itself is malformed (e.g. missing `client_id` or unregistered `redirect_uri`). No redirect is performed.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/OAuthError"
                }
              }
            }
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "OAuthError": {
        "type": "object",
        "description": "Standard OAuth 2.0 error envelope per RFC 6749 §5.2. Deliberately distinct\nfrom Vibe's `ErrorResponse` envelope so off-the-shelf OAuth client\nlibraries parse error responses correctly.\n",
        "required": [
          "error"
        ],
        "properties": {
          "error": {
            "type": "string",
            "description": "Error code defined by RFC 6749.",
            "enum": [
              "invalid_request",
              "invalid_client",
              "invalid_grant",
              "unauthorized_client",
              "unsupported_grant_type",
              "invalid_scope"
            ]
          },
          "error_description": {
            "type": "string",
            "description": "Human-readable explanation of the error."
          },
          "error_uri": {
            "type": "string",
            "format": "uri",
            "description": "URI of a page with more information about the error."
          }
        }
      }
    }
  }
}
```