Authorization Endpoint (POST)

POST

/oidc/authorize

const url = 'https://auth.timetonic.com/oidc/authorize';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/x-www-form-urlencoded'},
  body: new URLSearchParams({
    client_id: 'example',
    redirect_uri: 'https://example.com',
    response_type: 'code',
    scope: 'example',
    state: 'example',
    nonce: 'example',
    code_challenge: 'example',
    code_challenge_method: 'S256'
  })
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://auth.timetonic.com/oidc/authorize \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data client_id=example \
  --data redirect_uri=https://example.com \
  --data response_type=code \
  --data scope=example \
  --data state=example \
  --data nonce=example \
  --data code_challenge=example \
  --data code_challenge_method=S256

Same contract as GET /oidc/authorize (routes/web.php matches both get+post to AuthorizationController::authorize). Accepts the same parameters as form fields instead of query string — used by flows that resume the authorization request via a form post (e.g. after 2FA / SSO redirects) rather than a query-string redirect.

Request Body^required

application/x-www-form-urlencoded

object

client_id

required

string

redirect_uri

required

string format: uri

response_type

required

string

Allowed values: code

scope

required

string

state

required

string

nonce

string

code_challenge

required

string

code_challenge_method

required

string

Allowed values: S256

Responses

302

Redirect to redirect_uri with authorization code

401

Authentication required (returns oidc_request_id)

Authorization Endpoint (POST)

Request Bodyrequired

Responses

302

401

Request Body^required