# Approve an OAuth authorization request.

Approves only the permissions displayed and selected by the user. Sensitive custom permissions require a separate confirmation.

Canonical: https://commentary.dev/docs/reference/api/approve-oauth-authorize-request

`POST /oauth/authorize`

Approves only the permissions displayed and selected by the user. Sensitive custom permissions require a separate confirmation.

## Access

Use a credential with the authentication scheme documented in the API contract.

Provider access, workspace membership, and agent grants are enforced separately. A token does not expand access to a repository or resource. [Set up developer access](/docs/build/developer-access).

## Request body

Optional. Supported content types: `application/x-www-form-urlencoded`.

## Call the endpoint

Replace path placeholders and your credential. For body operations, create `request.json` using the required fields above; this command does not invent resource identifiers or consent.

```bash
curl --request POST \
  'https://commentary.dev/oauth/authorize' \
  --header 'Authorization: Bearer <your-token>' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data-binary @request.json
```

## Responses

| Status | Meaning | Payload |
| --- | --- | --- |
| `302` | Redirect to the client with an authorization code or error. | See response headers or body contract |

## Recover from errors

Use the returned status and error body. Correct invalid fields before retrying; reconnect or narrow the target for authentication and permission errors. For conditional writes, reload the latest version before preparing a new request. Respect rate-limit headers and retry only when the operation’s idempotency contract permits it.

## Contract and related guidance

Operation ID: `approveOAuthAuthorizeRequest`. [Download the OpenAPI contract](/docs/reference/openapi.json) for complete constraints and code generation. [Browse endpoints](/docs/reference/api-operations).