Show the OAuth2 login page
curl --request GET \
--url https://web-api.soxai.site/oauth2/loginimport requests
url = "https://web-api.soxai.site/oauth2/login"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://web-api.soxai.site/oauth2/login', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<string>{
"error": "bad-request",
"error_msg": "Invalid redirect_uri."
}{
"error": "not-found",
"error_msg": "Client not found."
}{
"error": "unprocessable-entity",
"error_msg": "body.<field>: <validation message>"
}{
"error": "rate-limited",
"error_msg": "Rate limit exceeded. Retry after <n> seconds."
}{
"error": "internal-server-error",
"error_msg": "Failed to fetch data: <error_message>"
}OAuth2
Show the OAuth2 login page
Render the SOXAI login page that starts the OAuth2 authorization code flow. A third-party client sends the user’s browser here.
The request is validated against the client registration before the page is shown: an unknown
client_id, a redirect_uri that is not the registered one, or a scope wider than the
client was granted are all refused rather than rendered.
Parameters
client_id(query, required) - the registered OAuth2 client.redirect_uri(query, required) - must equal the URI registered for that client.scope(query, required) - must be a subset of the scope registered for that client.state/nonce(query, optional) - passed through to the redirect.
Redirect URIs and testing
- Production clients are registered with an
httpsredirect URI only. A loopback URI such ashttp://localhost:8000/callbackis not accepted in Production. - To test the flow from a local machine, use the test client and the test environment that SOXAI provides. Loopback redirect URIs are accepted only there.
Response
200returns the login page as HTML. After successful sign-in, the browser continues through the authorization flow.
Errors
| Status | Condition |
|---|---|
| 400 | redirect_uri does not match the registration, or scope exceeds what the client may request |
| 404 | client_id is not registered |
Authorization
- No authentication. This is part of the OAuth2 authorization flow, which runs before the caller has a SOXAI token.
GET
/
oauth2
/
login
Show the OAuth2 login page
curl --request GET \
--url https://web-api.soxai.site/oauth2/loginimport requests
url = "https://web-api.soxai.site/oauth2/login"
response = requests.get(url)
print(response.text)const options = {method: 'GET'};
fetch('https://web-api.soxai.site/oauth2/login', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<string>{
"error": "bad-request",
"error_msg": "Invalid redirect_uri."
}{
"error": "not-found",
"error_msg": "Client not found."
}{
"error": "unprocessable-entity",
"error_msg": "body.<field>: <validation message>"
}{
"error": "rate-limited",
"error_msg": "Rate limit exceeded. Retry after <n> seconds."
}{
"error": "internal-server-error",
"error_msg": "Failed to fetch data: <error_message>"
}Query Parameters
Response
The login page, as HTML. After successful sign-in, the browser continues through the authorization flow.
The response is of type string.