# Authorization Request

`GET /oauth/oidc/authorize`

Initiate the Authorization Code + PKCE flow. This endpoint should be opened in the user's browser. The user will complete identity onboarding as needed, then be redirected to the `redirect_uri` with an authorization `code` parameter.

### Steps
1. Generate PKCE `code_verifier` (43-128 unreserved characters)
2. Compute `code_challenge` as `BASE64URL(SHA256(code_verifier))`
3. Redirect user's browser to this endpoint
4. User completes identity verification
5. User is redirected to `redirect_uri` with `code` and `state` parameters
6. Exchange `code` at the token endpoint

Parameters, request body, responses and error codes for this
endpoint are generated from the OpenAPI description. Read it at
/dist/docs/openapi.yaml for the machine-readable version.