Accounts & authentication

Start an OAuth authorization

GET /oauth/authorize

Starts a ten-minute consent request for the MCP resource. Send client_id, redirect_uri, response_type=code, code_challenge and code_challenge_method=S256. Optional scope defaults to read; write includes read. Optional resource defaults to this server's /mcp. State is returned unchanged. Only approval redirects automatically; authorization errors are HTML and show a Back link once the client and redirect are verified.

Parameters

client_idquery · required · string: Registered client ID or client metadata URL.
redirect_uriquery · required · string: A registered redirect URI.
response_typequery · required · string: Must be code.
code_challengequery · required · string: The S256 PKCE challenge.
code_challenge_methodquery · required · string: Must be S256.
scopequery · optional · string: Space-separated read, write and offline_access.
statequery · optional · string: Client state, at most 2 KiB.
resourcequery · optional · string: The issuer's /mcp resource.
response_modequery · optional · string: If supplied, must be query.

Example request

curl --request GET 'https://commitscale.com/oauth/authorize?client_id=example&redirect_uri=example&response_type=example&code_challenge=example&code_challenge_method=example'

Example values illustrate the format. Use your own credentials and identifiers.

Responses

303 Continue to Commitscale's consent page.

RateLimit and RateLimit-Policy describe the request rate. Follow Retry-After when a response asks you to wait.

Problem responses

Errors use application/problem+json. Act on the stable code, and follow next when present. See the problem format.

quota_exceeded429

With 429, the caller used its requests for the minute. With 422, a count limit was reached.

With 429, wait Retry-After seconds and retry. With 422, remove one first.