> ## Documentation Index > Fetch the complete documentation index at: https://docs.cocoondata.com/llms.txt > Use this file to discover all available pages before exploring further. # /api/oauth/authorize ## URL structure ```text theme={null} https://access-service.xy-company.com/api/oauth/authorize ``` ## Supported methods and overview * `GET` - used to [initiate the process for obtaining an access token](/3.3/api/authentication-and-authorisation.md#initiating-authentication-and-authorisation) (and optional refresh token) using either the *authorization code* or *implicit* OAuth 2.0 grant types. ## Detailed description This API endpoint initiates the process for obtaining an [access token](/3.3/admin-platform/configuring-client-applications.md#grant-types) using either [authorization code](/3.3/api/authentication-and-authorisation.md#using-the-authorization-code-grant-type) or [implicit](/3.3/api/authentication-and-authorisation.md#using-the-implicit-grant-type) OAuth 2.0 grant types. When using the implicit grant type, the access token itself is returned in the [response](/3.3/api/access-service-api-oauth-authorize.md#access-service-api-authorize-token-returns) to this API endpoint. (All other grant types return their access tokens in calls to the [\/api/oauth/token](/3.3/api/access-service-api-oauth-token.md) endpoint.) If the [client application has been configured](/3.3/admin-platform/configuring-client-applications.md) on the Covata Platform to issue refresh tokens, then a refresh token will accompany the access token. However, regardless of this configuration, refresh tokens are never issued when using the implicit grant type. ## Required parameters The following required parameters must be sent in the **URL** of the request: * **response\_type** - For the *authorization code* grant type, specify the string value `code` or for the *implicit* grant type, specify `token`. * **client\_id** - The client ID of your application's client credentials, which would have been generated when your application was [registered](/3.3/api/authentication-and-authorisation.md#registering-your-application-on-the-platform) on the Covata Platform. * **redirect\_uri** - Your application's URL/URI, which for the: * *authorization code* grant type, will handle the initial response from the Covata Platform that contains the actual authorization code. This initial response is sent after the user has successfully authenticated. * *implicit* grant type, will handle the response from the Covata Platform that contains the access token itself. This response is sent after the user has successfully authenticated. **Example (request - using the authorization code grant type):** ```text theme={null} https://access-service.xy-company.com/api/oauth/authorize?response_type=code&client_id=exampleClientApplication&redirect_uri=https%3A%2F%2Fmy-application-url%2Fauthcallback ``` This request results in the Covata Platform presenting the user with the Covata Sign-in page. If the client application requesting this API endpoint was developed by a third party (i.e. a non-Covata client application), then an additional page is presented requesting the user to approve the client application access to the user's resources on the Covata Platform. This step is known as the *application approval* step and only needs to be performed once (unless this approval is subsequently [revoked by the user](/3.3/api/access-service-api-v1-users-me-applications-approvals-approvalid.md)). ## Returns Once the Covata user has successfully authenticated (and if required, has accepted the *application approval* step), the Covata Platform responds by redirecting to your application's URL/URI (i.e. the `redirect_uri` value above), whose following URL parameters depend on the grant type used: * **code** ( *Authorization code grant type only* ) - The authorization code value. * **access\_token** ( *Implicit grant type only* ) - The access token itself, as a [JSON Web Token (JWT)](https://jwt.io/introduction/) value. The resources (i.e. API endpoints) of the Covata Platform that this access token grants permission to are based on the Covata user whose credentials were used for authentication, this user's [roles](/3.3/admin-org/administering-users-within-an-organisation.md#an-organisation-users-roles) (explained in more detail in the [Organization Administrator's Guide](/3.3/admin-org.md)) and if applicable to the API endpoint, the user's: * membership of organizations and * ownership or collaborator status on files or folders. * **token\_type** ( *Implicit grant type only* ) - The brief description for the type of token (above) - i.e. usually `bearer`. * **scope** ( *Implicit grant type only* ) - . * **jti** ( *Implicit grant type only* ) - The UUID value for the returned JWT access token. This value is a unique ID for the returned JWT, which is also known as a JWT ID. \ **Example (response/redirect - using the authorization code grant type):** ```text theme={null} https://my-application-url/authcallback?code=lEQmsFkB02NGPaB3YtaDnA ``` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.