# `POST /mcp/authorize`

Protected. Requires a valid session cookie (`credentials: 'include'`).

Grant or deny MCP client authorization

Issues an OAuth authorization code or refusal for the requesting MCP client on behalf of the authenticated user.

## Body (JSON)

| Field | Required | Type | Description |
|-------|----------|------|-------------|
| `client_id` | yes | string |  |
| `redirect_uri` | yes | string |  |
| `code_challenge` | no | string |  |
| `code_challenge_method` | no | string |  |
| `state` | no | string |  |
| `scope` | no | string |  |
| `action` | yes | string |  |

```json
{
  "client_id": "…",
  "redirect_uri": "…",
  "code_challenge": "…",
  "code_challenge_method": "…",
  "state": "…",
  "scope": "…",
  "action": "allow"
}
```

## Response `200`

Success with redirect URL containing code or error

## Errors

| Status | Description |
|--------|-------------|
| 400 | Invalid request parameters |
| 401 | User not authenticated |
| 404 | Client not found |

---

_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._