OAuth 2.1

Start authorization

Starts the authorization-code flow with PKCE. Interactive requests are redirected to the UFW sign-in UI. Authorization codes expire after five minutes.

Authentication

Authorizationnot required

This endpoint is public and takes no access token.

Responses

302Redirect to the next step

400The request is invalid

429Rate limit exceeded

const response = await fetch('https://api.ufw.dev/oauth2/v2.0/authorize', {
  method: 'GET',
});

const data = await response.json();

Response302

302 Found
Location: https://auth.ufw.dev/signin?request=…

# On approval, the browser returns to your redirect_uri:
# https://example.com/oauth/callback?code=…&state=…&iss=https%3A%2F%2Fapi.ufw.dev%2Foauth2%2Fv2.0