OAuth authorize
curl --request GET \
--url https://chatatp-agent-builder-backend.onrender.com/oauth/authorize/ \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://chatatp-agent-builder-backend.onrender.com/oauth/authorize/', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://chatatp-agent-builder-backend.onrender.com/oauth/authorize/"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)OAuth 2.1
OAuth authorize
Start an OAuth 2.1 authorization-code flow
GET
/
oauth
/
authorize
/
OAuth authorize
curl --request GET \
--url https://chatatp-agent-builder-backend.onrender.com/oauth/authorize/ \
--header 'Authorization: Bearer <token>'const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://chatatp-agent-builder-backend.onrender.com/oauth/authorize/', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://chatatp-agent-builder-backend.onrender.com/oauth/authorize/"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)Send the user’s browser to the Studio consent URL:
The user must be signed in to ChatATP Studio. Studio displays the app name, logo, developer, and requested permissions. After approval, Studio redirects to the registered
Public clients without PKCE receive an
https://studio.chat-atp.com/oauth/authorize/?client_id=CLIENT_ID&redirect_uri=https%3A%2F%2Fyour-app.example.com%2Foauth%2Fcallback&response_type=code&scope=agents%3Aread%20messages%3Asend&state=STATE&code_challenge=CHALLENGE&code_challenge_method=S256
redirect_uri with code and state. On cancellation it returns error=access_denied and the original state.
Query parameters
| Parameter | Required | Description |
|---|---|---|
client_id | Yes | OAuth application client ID. |
redirect_uri | Yes | Must exactly match a registered URI. |
response_type | Yes | Must be code. |
scope | Yes | Space-separated scopes allowed by the application. |
state | Recommended | CSRF protection value generated by your application. |
code_challenge | Public clients | Base64url SHA-256 challenge for the verifier. |
code_challenge_method | Public clients | S256. |
invalid_request error.