`GET /oauth/authorize`

OAuth uses S256 PKCE, an exact redirect URI and a separate resource for REST or MCP. Consent is completed in Tong. Refresh tokens rotate on every use.

Request example#

curl 'https://platform.tongai.io/oauth/authorize?client_id=https%3A%2F%2Fyour-app.example%2Foauth%2Fclient.json&redirect_uri=https%3A%2F%2Fyour-app.example%2Foauth%2Fcallback&resource=https%3A%2F%2Fplatform.tongai.io%2Fmcp&scope=catalog%3Aread+operations%3Aread&code_challenge=BASE64URL_SHA256_OF_VERIFIER&code_challenge_method=S256&response_type=code&state=RANDOM_SESSION_STATE'

Configuration

curl --version

Authentication#

none

Parameters#

client_idstringRequired

redirect_uristringRequired

resourcestringRequired

scopestringRequired

code_challengestringRequired

code_challenge_methodstringRequired

response_typestringRequired

statestringOptional

Request body#

This endpoint has no request body.

Response schema#

Response

Open the authorization URL in the user’s browser. Tong shows consent, then sends an authorization code to the registered redirect URI.

HTTP

HTTP/1.1 302 FoundLocation: https://tongai.io/developers/authorize?id=e8aa0a87-6cd9-42eb-975a-b72bf43218c8

The response has no body.

Errors and limits#

Response

JSON

{  "error": "invalid_request"}

AuthenticationAPI keys charge the account that owns the key. OAuth lets each connected user use their own credits.Errors and rate limitsUnderstand error responses, retry safely and recover from failed generations.Requests and logsAn accepted request is not a finished generation. Track the saved job until its output is ready.