Skip to main content
POST https://api.getkato.io/oauth/authorize Issue a one-time authorization code after a signed-in member selects a workspace. See OAuth flow and credentials for client registration, authorization, and token rotation. Requires an authenticated Kato user session, not a developer or OAuth bearer token. The consent UI calls this route after the user chooses a workspace. The response is JSON containing a redirectUrl, not an HTTP redirect. Codes expire after five minutes and can be exchanged once. Invalid clients/redirects return 400; unavailable workspaces return 404.

​
Parameters

​
string
required
Registered client ID, 1–100 characters; currently kato-raycast.
​
string
required
Allowed client redirect URL, up to 1,000 characters.
​
string
required
Base64url S256 challenge, 43–128 characters.
​
string
required
Must be S256.
​
string
required
Client-generated state, 8–1,000 characters; validate it on callback.
​
string
required
Workspace slug, 1–100 characters. The session user must be a member.

​
Response

200 — Returns the resource under data. Example IDs and values are illustrative.
200

​
Compatibility alias

POST /raycast/oauth/authorize calls the same handler. Use /oauth/authorize for new clients.

​
Request body example

Create the challenge from your verifier; the placeholder above is not a usable challenge.