Skip to main content
GET
Authorize a user
Open this endpoint in the user’s browser. Do not call it as a backend API.
Use the Authorization Code flow. PKCE is optional. If you use PKCE, use code_challenge_method=S256 and generate a new verifier for every authorization request. After authentication, Eka redirects the browser to your registered redirect_uri with a single-use authorization code. Your client application should verify state before exchanging the code. If your authorization request includes a nonce, your client should verify it when validating the returned ID token.
Eka always grants this fixed scope set. Include it as the scope query parameter: openid profile email offline_access.

Query Parameters

response_type
enum<string>
required

Use code for the Authorization Code flow.

Available options:
code
client_id
string
required

Client identifier issued by Eka.

redirect_uri
string<uri>
required

Callback URL that receives the authorization response. It must exactly match a redirect URI registered for the client.

scope
enum<string>
default:openid profile email offline_access
required

Fixed scope set for this endpoint: openid profile email offline_access.

Available options:
openid profile email offline_access
state
string
required

Unpredictable value used by the client to prevent CSRF. Verify that the same value is returned to the callback. Use at least 8 characters.

Minimum string length: 8
nonce
string

Unpredictable value that binds the client session to the ID token. Verify the returned ID token contains the same value.

code_challenge
string

Base64url-encoded SHA-256 digest of the PKCE code_verifier. Required only when using PKCE.

code_challenge_method
enum<string>

PKCE transformation method. Use S256.

Available options:
S256
prompt
enum<string>

Set to login to require the user to authenticate again.

Available options:
login
max_age
integer<int64>

Maximum allowed age of the user's Eka authentication session, in seconds. Eka requires authentication again when the session is older. A value of 0 always requires authentication.

Required range: x >= 0

Response

The browser is redirected to redirect_uri. On success, the query contains code, state, and the granted scope. On an OAuth error, it contains error, error_description, and state.