> ## Documentation Index
> Fetch the complete documentation index at: https://docs.insforge.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Initiate OAuth flow (PKCE)

> Generate OAuth authorization URL for any supported provider using PKCE flow.

For mobile/desktop/server clients using PKCE:
1. Generate code_verifier (random string, 43-128 chars)
2. Generate code_challenge = Base64URL(SHA256(code_verifier))
3. Call this endpoint with code_challenge
4. After OAuth callback, use /api/auth/oauth/exchange with code_verifier




## OpenAPI

````yaml https://raw.githubusercontent.com/InsForge/InsForge/main/openapi/auth.yaml get /api/auth/oauth/{provider}
openapi: 3.0.3
info:
  title: Insforge Authentication API
  version: 2.0.0
  description: Authentication endpoints with separated auth and profile tables
servers: []
security: []
paths:
  /api/auth/oauth/{provider}:
    get:
      tags:
        - Client
      summary: Initiate OAuth flow (PKCE)
      description: >
        Generate OAuth authorization URL for any supported provider using PKCE
        flow.


        For mobile/desktop/server clients using PKCE:

        1. Generate code_verifier (random string, 43-128 chars)

        2. Generate code_challenge = Base64URL(SHA256(code_verifier))

        3. Call this endpoint with code_challenge

        4. After OAuth callback, use /api/auth/oauth/exchange with code_verifier
      parameters:
        - name: provider
          in: path
          required: true
          schema:
            type: string
            enum:
              - google
              - github
              - discord
              - linkedin
              - facebook
              - instagram
              - tiktok
              - apple
              - x
              - spotify
              - microsoft
        - name: redirect_uri
          in: query
          required: true
          schema:
            type: string
            format: uri
          description: >-
            URL to redirect after authentication (receives insforge_code
            parameter)
        - name: code_challenge
          in: query
          required: false
          schema:
            type: string
          description: >
            PKCE code challenge for mobile/desktop/server clients.

            Generate using: Base64URL(SHA256(code_verifier))

            Required for secure token exchange in native apps or trusted
            server-side clients.
      responses:
        '200':
          description: OAuth authorization URL
          content:
            application/json:
              schema:
                type: object
                properties:
                  authUrl:
                    type: string
                    format: uri
                    description: URL to redirect user for OAuth provider login
        '400':
          description: Invalid request or provider not supported
        '500':
          description: OAuth not configured

````