POST/oauth/authorize/grant

API key required, sent as an admin token.

What it does

The website calls this only after (a) validating its own console session server-side and (b) a human pressing "Allow". The identity must already exist (the console sign-in proved it), so this endpoint never creates one.

It DOES create a key when the identity has none: the sign-in proved mailbox control, which is exactly the evidence /v1/keys/verify accepts, so the minted key is verified on the standard free tier rather than a provisional one that would expire under the user mid-use.

Call it

bash

curl -fsS -X POST "https://api.mapmap.ai/oauth/authorize/grant" \
  -H "Authorization: Bearer $MAPMAP_KEY" \
  -H "Content-Type: application/json" \
  -d @request.json

Request body

application/json · GrantRequest

Field	Type	Required	Description
client_id	string	yes	The client the code is for: a registered UUID, or an https client-id metadata document URL (CIMD).
client_kind_hint	string	no	Hint at the client kind (`"dcr"` / `"cimd"`); advisory only — the gateway decides from the id's own shape.
code_challenge	string	yes	PKCE S256 challenge (base64url, unpadded, 43 characters).
identity_email	string	yes	Delivery email of the signed-in identity. Server-supplied: the website reads it from its own validated console session, never from anything the browser posted.
redirect_uri	string	yes	Redirect URI the authorize request carried; must be one the client registered (loopback matches on any port).
scope	string	no	Requested scope; narrowed to what this server grants.

Responses

200Authorization code minted

Field	Type	Required	Description
code	string	yes	The authorization code. The website appends it — with `state` and `iss` — to the redirect; it must never be rendered or logged.
expires_in	integer	yes	Code lifetime in seconds.
redirect_uri	string	yes	The redirect URI the code is bound to (echoed so the website redirects to exactly what was validated).

400Bad challenge, redirect URI, or client metadata document

401Missing or wrong admin token

404Unknown client or identity

501OAuth not configured on this deployment

Error bodies follow the shared problem model documented on API conventions.

Also under oauth

GET /.well-known/oauth-authorization-server POST /oauth/register POST /oauth/token

Generated from https://api.mapmap.ai/openapi.json on 2026-09-17 · operationId authorize_grant