Authorization endpoint

As explained in Secure APIs

An authorization endpoint is an identity or authorization service endpoint where a client initiates a user authorization and authentication flow.

An authorization endpoint is the identity or authorization service URL where a client begins user authentication and authorization. In an OIDC flow, the API redirects the user there; after successful login and consent, the provider redirects back with an authorization code. section 8.4.1 section 8.7

Figure 8.3 Flow of requests involved in obtaining an access token. The process begins with the user visiting the server’s login page. The API redirects the client to Auth0’s login screen, where the user authenticates and grants consent; then the user is redirected back to the API with the authorization code, which is finally exchanged for an access token.

The flow connects the client’s login route, the provider’s authorization screen, the returned authorization code, and the later token exchange. section 8.4.1

Construct the authorization request with the values that identify the intended flow:

• Use the authorization_endpoint value returned by the provider’s discovery endpoint. section 8.4.1
• Set response_type to code for an authorization-code response, and include the client_id. section 8.4.1
• Specify the audience when several APIs exist and the redirect_uri when several redirect URIs are configured. section 8.4.1

FastAPI login route

A GET /login route redirects the browser to https://apithreats.eu.auth0.com/authorize with response_type=code, a configured client_id, redirect_uri, and audience. The provider later returns a code, which the server exchanges with the client secret for an access token. section 8.4.1

How Secure APIs covers it

How deep it goes

Explains discovery, request parameters, redirects, and code exchange, but stops short of detailed endpoint implementation internals.

Examples

Uses an Auth0 authorization URL, a FastAPI GET /login route, and a returned code exchanged through GET /token.

What it assumes

Assumes basic client-server and API familiarity while defining discovery, authorization requests, authorization codes, and access tokens through the flow.

What you can do after

Apply it via an OIDC provider by redirecting users to the discovered endpoint and exchanging the returned code for an access token.

How it connects

Connects OIDC providers, discovery endpoints, authorization codes, access tokens, redirect URIs, audiences, and client applications.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

Also explained in

• 

  liveBookmanning.com
  Software Security for DevelopersAn authorization endpoint is an identity provider endpoint where a client initiates user authorization and authentication.
• 

  liveBookmanning.com
  Spring Security in Action, Second EditionAn authorization endpoint is an OAuth endpoint where a client initiates an authorization request and a resource owner's authorization is obtained.

Compare how 3 books explain authorization endpoint →

Related concepts

• authorization codeproduces · An authorization code is a short-lived credential issued by an authorization server for a client to exchange for an access token.
• openid configuration endpointproduced by · An OpenID configuration endpoint is a standardized endpoint that publishes an OpenID Connect provider's metadata, supported endpoints, and protocol configuration.
• OIDC discoveryproduced by · OIDC discovery is a standard data structure and endpoint convention for publishing an OpenID Provider’s configuration and capabilities.
• endpointkind of · An endpoint is a network-accessible address or interface through which a service exposes a resource or operation and handles requests and responses.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.