Authorize OAuth client

GET/api/oauth/authorize

This endpoint isn’t available for live testing.

curl 'https://app.quote.cloud/api/oauth/authorize?client_id=<your client id>&redirect_uri=<redirect_uri>&response_type=code'

Inputs

client_idrequiredYou don’t need to enter this here. In your own code, use the Client ID from your OAuth client. How to get one

redirect_urirequiredWhere to send the person after they allow access. It must exactly match a redirect URI saved on your OAuth client.

response_typerequiredAlways code.

stateAny random value you choose. It comes back unchanged with the redirect, so you can check the response belongs to the request you started.

scopeThe scopes to ask for, separated by spaces.

code_challengeThe PKCE challenge you generated. Required for public clients, which have no client secret.

code_challenge_methodHow the challenge was made. Defaults to plain. Public clients must use S256.

Not sure what to enter? Here’s where to find IDs

Example response

A 307 response has no body in the spec.

Start the OAuth authorization-code flow

Validates the client and exact redirect URI, then redirects the browser to login or the company session picker. PKCE plain and S256 are supported; code_challenge_method defaults to plain when a challenge is supplied without a method.

Permission

No credentials needed.

Parameters

Not sure what to enter? Here’s where to find IDs.

client_idquery · stringrequired

The Client ID of your OAuth client. Find it in QuoteCloud under Settings → API dashboard → Manage Integrations → OAuth Clients.Length at least 1.

redirect_uriquery · string (uri)required

Where to send the person after they allow access. It must exactly match a redirect URI saved on your OAuth client.

response_typequery · stringrequired

Always code.Always code.

statequery · string

Any random value you choose. It comes back unchanged with the redirect, so you can check the response belongs to the request you started.

scopequery · string

The scopes to ask for, separated by spaces.

code_challengequery · string

The PKCE challenge you generated. Required for public clients, which have no client secret.

code_challenge_methodquery · string

How the challenge was made. Defaults to plain. Public clients must use S256.One of plain, S256.

Responses

307Redirect to QuoteCloud login or the company session picker.

Locationheader · string (uri-reference)

No response body.

400Invalid OAuth request, grant, code, redirect URI, or grant type.

errorstringrequired

error_descriptionstring

401Invalid OAuth client credentials or access token.

errorstringrequired

error_descriptionstring

500OAuth server error.

errorstringrequired

error_descriptionstring