Are you an LLM? Read llms.txt for a summary of the docs, or llms-full.txt for the full context.
Skip to content

Authorization

The authorization endpoint initiates the OAuth2 Authorization Code flow. Aero2 requires PKCE with S256 for all authorization requests.

GET/oauth2/authorizeSession

Initiates the OAuth2 Authorization Code flow with PKCE. Redirects the user to authenticate, then returns an authorization code to the redirect_uri. PKCE with S256 is mandatory.

ParameterTypeDescription
client_id*
query		stringThe registered OAuth client ID
redirect_uri*
query		stringMust match a registered redirect URI for the client
response_type*
query		stringMust be "code"
scope
query		stringSpace-separated scopes: openid, profile, email
state
query		stringOpaque value for CSRF protection
code_challenge*
query		stringPKCE code challenge (base64url-encoded SHA-256)
code_challenge_method*
query		stringMust be "S256"
nonce
query		stringValue included in the ID token for replay protection
Response
HTTP 302 → redirect_uri?code=abc123&state=xyz
Try in Playground →

Flow Overview

  1. Your app generates a PKCE code_verifier and code_challenge
  2. Redirect user to /oauth2/authorize with the challenge
  3. User authenticates with Aero2
  4. Aero2 redirects back to your redirect_uri with an authorization code
  5. Exchange the code at the Token endpoint with the code_verifier

See Authorization Code Flow for a detailed walk-through.