Access control
Authorize OAuth
Send a user to sign in and receive an OAuth authorization code.
/oauth/authorizeAuthorize OAuth starts sign-in for an OAuth client. Send the user’s browser to this URL. Blnk shows the sign-in page, then redirects to redirect_uri with a code.
Send this request to https://api.cloud.blnkfinance.com on Blnk Cloud. On a self-hosted Enterprise deployment, send it to ENTERPRISE_PUBLIC_URL.
The code lasts 10 minutes and works once. Exchange it with Create OAuth token.
Query
response_typestring
Must be code.
client_idstring
Client id from OAuth.
redirect_uristring
Callback URL. It must be one of the redirect URIs registered on the client, and the same value you send to Create OAuth token.
scopestring
Space-separated scopes to request, such as mcp:read data:read. Omit it to use the scopes on the client.
statestring
Value your app sends and checks on the redirect.
code_challengestring
PKCE challenge. If you send this, Create OAuth token must include code_verifier.
code_challenge_methodstring
S256 or plain. Used with code_challenge. plain compares the verifier to the challenge directly.
Response
Blnk returns the sign-in page. After the user signs in, Blnk redirects to redirect_uri with 302.
The code query parameter is the authorization code. state comes back when you sent it.
An unknown client_id, or a redirect_uri that is not registered, shows an error page and does not redirect.