Authorization screen / consent
Step 1 of the OAuth 2.0 Authorization Code + PKCE (S256) flow. Redirect the user to this URL; after Rocketpunch login and consent, a one-time code and state are returned to the registered redirect_uri. Success returns 302 with code+state; user denial returns 302 with error+state; an unregistered client_id or redirect_uri mismatch returns a 400 HTML page without redirect. The currently consentable scopes are profile and email, and requested scopes are approved or denied together. Exchange the received code with code_verifier at POST /oauth/token (grant_type=authorization_code). code_challenge = BASE64URL(SHA256(code_verifier)).
Headers
Supported response locales: ko, en, ja, zh-CN, zh-TW, es, fr, de, pt, th, vi. Default is ko.
"ko"
Query Parameters
Always code
Registered OAuth client ID
Must exactly match a pre-registered redirect URI
Requested scopes (space-separated)
Opaque value for CSRF protection (recommended)
PKCE code challenge (BASE64URL(SHA256(verifier)))
Always S256
Response
Consent screen (HTML)