Authorization Endpoint

OAuth2 Authorization Endpoint (redirects to consent screen)

curl --request GET \
  --url https://api.timbrix.mx/oauth/authorize

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.timbrix.mx/oauth/authorize",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.timbrix.mx/oauth/authorize"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.timbrix.mx/oauth/authorize")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body

GET

oauth

authorize

OAuth2 Authorization Endpoint (redirects to consent screen)

curl --request GET \
  --url https://api.timbrix.mx/oauth/authorize

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.timbrix.mx/oauth/authorize",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.timbrix.mx/oauth/authorize"

	req, _ := http.NewRequest("GET", url, nil)

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.timbrix.mx/oauth/authorize")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)

response = http.request(request)
puts response.read_body

Entry point for the Authorization Code Flow. Validates the request and redirects the user’s browser to the Timbrix consent screen.

This is a browser redirect, not a direct API call. Construct the URL with the parameters below and redirect your user to it.

Rate-limited to 30 requests per minute.

Query Parameters

Parameter	Type	Required	Description
`client_id`	string	Yes	Your OAuth application client ID
`redirect_uri`	string	Yes	Redirect URI registered with your application
`scope`	string	Yes	Comma-separated list of requested scopes (e.g. `read:user,read:organization`)
`state`	string	Yes	Random value for CSRF protection — verify it matches on callback
`response_type`	string	Yes	Must be `code`
`code_challenge`	string	No	PKCE code challenge — Base64-URL encoded SHA-256 hash of your `code_verifier`
`code_challenge_method`	string	No	`S256` (recommended) or `plain`

Example

Construct the URL and redirect your user:

const params = new URLSearchParams({
  client_id: "app_1234567890abcdef",
  redirect_uri: "https://example.com/oauth/callback",
  scope: "read:user,read:organization",
  state: crypto.randomUUID(), // store this to verify on callback
  response_type: "code",
  // PKCE (recommended)
  code_challenge: "<base64url(sha256(code_verifier))>",
  code_challenge_method: "S256",
})

window.location.href = `https://api.timbrix.mx/oauth/authorize?${params}`

What happens next

The user is shown the Timbrix consent screen with the requested scopes
If the user approves, they are redirected to your redirect_uri with a code and state parameter
If the user denies, they are redirected with error=access_denied
Exchange the code for tokens using POST /oauth/token/exchange

Callback example

https://example.com/oauth/callback?code=code_abc123xyz&state=<your_state>

Always verify the state parameter matches the value you generated before proceeding.

Common Errors

400 Bad Request

Invalid client_id, redirect_uri mismatch, or unsupported response_type. On success, the user is redirected to the Timbrix consent screen — no JSON response is returned.

Query Parameters

client_id

string

required

OAuth application client ID

Example:

"app_abc123..."

redirect_uri

string

required

Redirect URI registered with the application

Example:

"https://example.com/oauth/callback"

scope

string

required

Comma-separated list of requested scopes

Example:

"read:user,read:organization"

state

string

required

CSRF protection state parameter. Client should generate a random value and verify it on callback.

Example:

"random_state_abc123"

response_type

string

default:code

required

Response type (must be 'code' for Authorization Code Flow)

Example:

"code"

code_challenge

string

PKCE code challenge (optional, for enhanced security). Base64-URL encoded SHA256 hash of code_verifier.

Example:

"E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM"

code_challenge_method

enum<string>

PKCE code challenge method. Use 'S256' for SHA256 hashing (recommended) or 'plain' for no hashing.

Available options:

S256,

plain

Example:

"S256"

Response

Redirects to consent screen with validated parameters. User will be prompted to authorize or deny the application.

API documentation

Organizations

Members

Invites

Auth

OAuth

Customers

SAT Catalogs

Invoices

Products

Users

Webhooks

API Keys

Query Parameters

Example

What happens next

Callback example

Common Errors

400 Bad Request

Query Parameters

Response

​Query Parameters

​Example

​What happens next

​Callback example

​Common Errors

​400 Bad Request

​302 → consent screen

Query Parameters

Response

Query Parameters

Example

What happens next

Callback example

Common Errors

400 Bad Request

302 → consent screen