> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getkato.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Authorize a workspace grant

> Issue a one-time authorization code after a signed-in member selects a workspace.

`POST https://api.getkato.io/oauth/authorize`

Issue a one-time authorization code after a signed-in member selects a workspace.

See [OAuth flow and credentials](/api-reference/oauth/overview) for client registration, authorization, and token rotation.

Requires an authenticated Kato user session, not a developer or OAuth bearer token. The consent UI calls this route after the user chooses a workspace. The response is JSON containing a redirectUrl, not an HTTP redirect. Codes expire after five minutes and can be exchanged once. Invalid clients/redirects return `400`; unavailable workspaces return `404`.

## Parameters

<ParamField body="clientId" type="string" required>
  Registered client ID, 1–100 characters; currently kato-raycast.
</ParamField>

<ParamField body="redirectUri" type="string" required>
  Allowed client redirect URL, up to 1,000 characters.
</ParamField>

<ParamField body="codeChallenge" type="string" required>
  Base64url S256 challenge, 43–128 characters.
</ParamField>

<ParamField body="codeChallengeMethod" type="string" required>
  Must be S256.
</ParamField>

<ParamField body="state" type="string" required>
  Client-generated state, 8–1,000 characters; validate it on callback.
</ParamField>

<ParamField body="workspaceSlug" type="string" required>
  Workspace slug, 1–100 characters. The session user must be a member.
</ParamField>

## Response

**200** — Returns the resource under `data`. Example IDs and values are illustrative.

```json 200 theme={null}
{
  "redirectUrl": "https://raycast.com/redirect?packageName=kato&code=EXAMPLE&state=EXAMPLE_STATE"
}
```

## Compatibility alias

`POST /raycast/oauth/authorize` calls the same handler. Use `/oauth/authorize` for new clients.

## Request body example

```json theme={null}
{
  "clientId": "kato-raycast",
  "redirectUri": "https://raycast.com/redirect?packageName=kato",
  "codeChallenge": "REPLACE_WITH_YOUR_BASE64URL_SHA256_PKCE_CHALLENGE",
  "codeChallengeMethod": "S256",
  "state": "REPLACE_WITH_RANDOM_STATE",
  "workspaceSlug": "northlane"
}
```

Create the challenge from your verifier; the placeholder above is not a usable challenge.


## Related topics

- [All endpoints](/api-reference/endpoints.md)
- [OAuth authorization](/api-reference/oauth/overview.md)
- [GitHub](/integrations/github.md)
- [Revoke an OAuth grant](/api-reference/oauth/revoke.md)
- [Create your workspace](/documentation/create-your-workspace.md)