Authorization endpoint (302 to AgentID)

Authorization code with mandatory S256, exact registered redirect, resource and state. Default redirects fixed AgentSub identity-choice/consent UI with an opaque five-minute request identifier. Optional identity_provider=agentid starts AgentID directly. Human Google/Clerk identity requires explicit trusted-origin human consent before a one-minute code is issued.

GET/oauth/authorize

Query parameters

response_typestringrequired

client_idstringrequired

redirect_uristring<uri>required

code_challengestringrequired

matches ^[A-Za-z0-9_-]{43}$

code_challenge_methodstringrequired

resourcestringrequired

scopestring

Space-separated requested actor scopes. Request both to offer human and agent login; the issued token contains only the selected identity scope. Omit to offer both.

matches ^\s*(agentsub:(agent|owner))(\s+agentsub:(agent|owner))*\s*$

statestringrequired

max length 2048

identity_providerstring

Allowed:clerkagentid

Responses

302

Redirect to AgentID upstream authorization

400

OAuth error JSON (invalid_request, invalid_client, invalid_grant, invalid_scope, invalid_target, invalid_redirect_uri, invalid_client_metadata, unsupported_grant_type)

errorstringrequired

Allowed:invalid_requestinvalid_clientinvalid_grantinvalid_scopeinvalid_targetinvalid_redirect_uriinvalid_client_metadataunsupported_grant_typeaccess_deniedtemporarily_unavailable

error_descriptionstringrequired

429

OAuth error JSON (temporarily_unavailable — registration/authorization caps reached)

errorstringrequired

Allowed:invalid_requestinvalid_clientinvalid_grantinvalid_scopeinvalid_targetinvalid_redirect_uriinvalid_client_metadataunsupported_grant_typeaccess_deniedtemporarily_unavailable

error_descriptionstringrequired

503

OAuth error JSON (temporarily_unavailable — credentials or storage not configured)

errorstringrequired

Allowed:invalid_requestinvalid_clientinvalid_grantinvalid_scopeinvalid_targetinvalid_redirect_uriinvalid_client_metadataunsupported_grant_typeaccess_deniedtemporarily_unavailable

error_descriptionstringrequired

Request

curl -X GET 'https://api.agentsub.dev/oauth/authorize?response_type=code&client_id=string&redirect_uri=http%3A%2F%2Fexample.com&code_challenge=string&code_challenge_method=S256&resource=string&state=string' \
  -H 'Accept: application/json'

const response = await fetch("https://api.agentsub.dev/oauth/authorize?response_type=code&client_id=string&redirect_uri=http%3A%2F%2Fexample.com&code_challenge=string&code_challenge_method=S256&resource=string&state=string", {
  method: "GET",
  headers: {
    "Accept": "application/json"
  }
});

import requests

response = requests.get(
    "https://api.agentsub.dev/oauth/authorize?response_type=code&client_id=string&redirect_uri=http%3A%2F%2Fexample.com&code_challenge=string&code_challenge_method=S256&resource=string&state=string",
    headers={
        "Accept": "application/json"
    },
)

Response

Redirect to AgentID upstream authorization

{
  "error": "invalid_request",
  "error_description": "string"
}

{
  "error": "invalid_request",
  "error_description": "string"
}

{
  "error": "invalid_request",
  "error_description": "string"
}