> ## Documentation Index
> Fetch the complete documentation index at: https://docs.timbrix.mx/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth2 Authorization Endpoint (redirects to consent screen)

> 🔓 PUBLIC ENDPOINT: Standard OAuth2 authorization endpoint. Validates request parameters and redirects to the consent screen. Supports PKCE for enhanced security. This is the entry point for Authorization Code Flow - compatible with standard OAuth2 clients.



## OpenAPI

````yaml https://api.timbrix.mx/api/openapi.json get /oauth/authorize
openapi: 3.0.0
info:
  title: Timbrix API
  description: >-
    API de facturación electrónica CFDI 4.0 para México, con servidor OAuth2
    para gestionar organizaciones, miembros y webhooks. Compatible con agentes
    de IA — ver la extensión `x-ai-agent-friendly` en la raíz de esta spec.


    REST API with OAuth2 server for managing organizations, members, and
    webhooks.
  version: '1.0'
  contact: {}
servers: []
security: []
tags:
  - name: organizations
    description: Organization management endpoints
  - name: oauth
    description: OAuth2 authentication and authorization
  - name: webhooks
    description: Webhook configuration and delivery
  - name: users
    description: User information endpoints
  - name: api-keys
    description: API Keys management and validation
paths:
  /oauth/authorize:
    get:
      tags:
        - oauth
      summary: OAuth2 Authorization Endpoint (redirects to consent screen)
      description: >-
        🔓 PUBLIC ENDPOINT: Standard OAuth2 authorization endpoint. Validates
        request parameters and redirects to the consent screen. Supports PKCE
        for enhanced security. This is the entry point for Authorization Code
        Flow - compatible with standard OAuth2 clients.
      operationId: OAuthController_authorize
      parameters:
        - name: client_id
          required: true
          in: query
          description: OAuth application client ID
          schema:
            example: app_abc123...
            type: string
        - name: redirect_uri
          required: true
          in: query
          description: Redirect URI registered with the application
          schema:
            example: https://example.com/oauth/callback
            type: string
        - name: scope
          required: true
          in: query
          description: Comma-separated list of requested scopes
          schema:
            example: read:user,read:organization
            type: string
        - name: state
          required: true
          in: query
          description: >-
            CSRF protection state parameter. Client should generate a random
            value and verify it on callback.
          schema:
            example: random_state_abc123
            type: string
        - name: response_type
          required: true
          in: query
          description: Response type (must be 'code' for Authorization Code Flow)
          schema:
            default: code
            example: code
            type: string
        - name: code_challenge
          required: false
          in: query
          description: >-
            PKCE code challenge (optional, for enhanced security). Base64-URL
            encoded SHA256 hash of code_verifier.
          schema:
            example: E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
            type: string
        - name: code_challenge_method
          required: false
          in: query
          description: >-
            PKCE code challenge method. Use 'S256' for SHA256 hashing
            (recommended) or 'plain' for no hashing.
          schema:
            example: S256
            type: string
            enum:
              - S256
              - plain
      responses:
        '302':
          description: >-
            Redirects to consent screen with validated parameters. User will be
            prompted to authorize or deny the application.
        '400':
          description: >-
            Invalid request parameters. Check client_id, redirect_uri, scope,
            state, and response_type.

````