Authorize
OAuth 2.1
Authorize
Start the PKCE authorization code flow.
GET
Authorize
Browser redirect. On success, redirects to
Errors:
{NEXT_PUBLIC_WEB_URL}/oauth/consent?....
From registration
Must match a registered URI
Must be
codePKCE challenge
Must be
S256Space-separated scopes
Opaque CSRF state
Resource indicator — use
https://mcp.costmcp.com400 HTML page, or 302 to client with error / error_description / state.