Authorization Endpoint

Initiates the OAuth 2.0 authorization flow. This endpoint supports multiple authentication flows including Authorization Code Flow, Authorization Code Flow with PKCE, Implicit Flow, and Hybrid Flow.

Supported Flows:

• Authorization Code Flow - Use response_type=code (for server-side apps)
• Authorization Code Flow with PKCE - Use response_type=code with code_challenge (for SPAs and mobile apps)
• Implicit Flow - Use response_type=token or response_type=id_token (deprecated)
• Hybrid Flow - Use response_type=code id_token or response_type=code token

The user will be redirected to Auth0’s login page to authenticate. After successful authentication, Auth0 redirects back to your redirect_uri with the appropriate response based on the response_type.

GET https://{yourDomain}/authorize

Organization Login

Authorization Code Flow

GET /authorize?
  response_type=code&
  client_id=YOUR_CLIENT_ID&
  redirect_uri=https://your-app.com/callback&
  scope=openid%20profile%20email&
  state=xyzABC123
Host: your-tenant.auth0.com

302

Authorizations

Authorization · string · header · required

The access token received from the authorization server in the OAuth 2.0 flow.

Query Parameters

response_type · enum<string> · required

Specifies the type of response you expect. Determines which OAuth 2.0 flow to use.

• code - Authorization Code Flow (returns authorization code)
• token - Implicit Flow for Access Token (returns access token)
• id_token - Implicit Flow for ID Token (returns ID token)
• id_token token - Implicit Flow (returns both)
• code id_token - Hybrid Flow
• code token - Hybrid Flow
• code id_token token - Hybrid Flow

Available options: code, token, id_token, id_token token, code id_token, code token, code id_token token

client_id · string · required

Your application's Client ID. You can find this value in your Application Settings.

redirect_uri · string<uri>

The URL to which Auth0 will redirect the browser after authorization has been granted by the user. This URL must be registered in your application's Allowed Callback URLs settings.

Note: Required for most flows, but may be optional if a default is configured.

scope · string

Space-delimited list of scopes you want to request authorization for. Include openid to get an ID Token. Include offline_access to get a Refresh Token.

OIDC Scopes:

• openid - Required for OpenID Connect
• profile - User profile info (name, picture, etc.)
• email - User email address
• address - User address
• phone - User phone number
• offline_access - Refresh token

Custom Scopes: You can also request custom API scopes defined in your Auth0 APIs.

state · string

An opaque arbitrary alphanumeric string your app adds to the initial request that Auth0 includes when redirecting back to your application. This value must be used by the application to prevent CSRF attacks.

Recommended: Always include this parameter for security.

audience · string

The unique identifier of the target API you want to access. This is the API Identifier found in your API settings.

When to use: Include this when requesting an Access Token to call a specific API.

code_challenge · string

Generated challenge from the code_verifier for PKCE flow. Required when using Authorization Code Flow with PKCE.

Format: BASE64URL(SHA256(code_verifier))

PKCE Flow: Used to prevent authorization code interception attacks in public clients (SPAs, mobile apps).

code_challenge_method · enum<string>

Method used to generate the challenge. Auth0 supports S256 (SHA-256).

Required when: Using code_challenge parameter.

Available options: S256

nonce · string

A random string value used to associate a client session with an ID Token and to mitigate replay attacks. The nonce value is included in the ID Token.

Required when: Using response_type that includes id_token (Implicit or Hybrid flows).

connection · string

The name of the connection configured for your application. Forces the user to sign in with a specific connection.

Examples: google-oauth2, facebook, Username-Password-Authentication, windowslive, linkedin

When to use: To skip the Auth0 Universal Login page and go directly to a specific identity provider.

prompt · enum<string>

Controls the authentication prompts presented to the user.

Values:

• none - Silent authentication (no prompts, fails if user is not logged in)
• login - Forces the user to re-enter credentials
• consent - Forces consent prompt even if consent was previously given
• select_account - Prompts user to select an account (when multiple sessions exist)

Use case: none is used for checking if a user is already authenticated without interrupting their experience.

Available options: none, login, consent, select_account

organization · string

ID of the organization to use when authenticating a user. When not provided, if your application is configured to Display Organization Prompt, the user will be able to enter the organization name when authenticating.

Use case: Authenticate users in the context of a specific organization (B2B scenarios).

invitation · string

Ticket ID of the organization invitation. When inviting a member to an Organization, your application should handle invitation acceptance by forwarding the invitation parameter along with the organization parameter when the user accepts the invitation.

Use case: Organization member invitation acceptance flow.

login_hint · string

Hint to the Authorization Server about the login identifier the user might use to log in. Can be an email address or other identifier.

Use case: Pre-fill the username/email field on the login page.

acr_values · string

Space-separated string that specifies the authentication context class reference values. Used to request specific authentication methods (e.g., MFA).

Example: http://schemas.openid.net/pape/policies/2007/06/multi-factor

max_age · integer

Maximum authentication age in seconds. If the elapsed time since the last authentication is greater than this value, the user must re-authenticate.

Use case: Require recent authentication for sensitive operations.

ui_locales · string

Space-delimited list of locales used to constrain the language list for the login page. The first locale on the list must match an enabled locale in your tenant.

Example: en es fr

response_mode · enum<string>

Specifies how the result of the authorization request is formatted.

Values:

• query - Response parameters encoded in query string (default for code)
• fragment - Response parameters encoded in URL fragment (default for token)
• form_post - Response parameters sent as form POST to redirect_uri
• web_message - For silent authentication in iframes

Available options: query, fragment, form_post, web_message

dpop_jkt · string

The JWK Thumbprint of the DPoP proof-of-possession public key using SHA-256 hash function (as defined in RFC 7638).

Use case: Demonstrating Proof-of-Possession (DPoP) for enhanced security in OAuth 2.0.

Response

302

Redirect response. Auth0 redirects the user to authenticate or redirects back to your application with the authorization result.

Authorization Code Flow: Redirects to redirect_uri with code and state parameters:

https://your-app.com/callback?code=AUTHORIZATION_CODE&state=xyzABC123

Implicit Flow (token): Redirects to redirect_uri with tokens in fragment:

https://your-app.com/callback#access_token=...&token_type=Bearer&expires_in=86400&state=xyzABC123

Implicit Flow (id_token): Redirects to redirect_uri with ID token in fragment:

https://your-app.com/callback#id_token=...&state=xyzABC123