oauth
Authorize endpoint
Redirects the user to Klang to sign in and approve your app's requested
scopes. On approval, Klang redirects back to your redirect_uri with an
authorization code and the state you passed in.
This is a browser redirect endpoint, not an API call you make from
your server. Build the URL and send the user there with a 302 or a
link click.
GET
/api/auth/oauth2/authorize Query parameters
| response_typeREQUIRED "code" | Must be code. |
| client_idREQUIRED string | Your client ID (ext_…). |
| redirect_uriREQUIRED string · uri | Exactly matches one of the redirect URIs registered on your client.
HTTPS required for production; http://localhost and
http://127.0.0.1 are allowed for local development.
|
| scopeREQUIRED string | Space-separated list of scopes. offline_access is always
granted automatically. Example:
email folders:read conversations:read members:read notes:read offline_access
|
| stateREQUIRED string | Random string your app generates. Klang returns it unchanged on the redirect. Verify it matches to prevent CSRF on the callback. |
| code_challenge string | PKCE code challenge (S256). Optional for external confidential clients, but recommended. |
| code_challenge_method "S256" | Must be S256 if code_challenge is sent. |