Step 1 — Authorize (browser redirect, documentation)

Overview

Browser-initiated top-level redirect — NOT a fetch/XHR call from your app. The user must hit this URL in their browser. Review Management then presents the consent screen and bounces back to your registered redirect_uri with a code.

Prerequisites

No authentication — this endpoint is public.
Values for the required query parameters client_id, redirect_uri, response_type, state — see the table below.

Base URL

Environment	URL
Production	`https://production-api.shoutaboutus.com`
Development	`https://development-api.shoutaboutus.com`

Endpoint

GET /oauth/authorize

Authentication

No bearer token required.

Rate limit

This endpoint does not declare a rate limit.

Query parameters

Parameter	Required	Description
`client_id`	Required	The id of the OAuth client you registered.
`redirect_uri`	Required	Must match a redirect URI registered against the client, character for character.
`response_type`	Required	Always `code` for the authorization-code flow.
`scope`	Optional	Space-separated scopes to request. No default scope is configured.
`state`	Recommended	An unguessable random string. Not enforced by the server, but strongly recommended: store it in the user's session and compare it when the callback arrives, to prevent CSRF.

Errors

Status	Meaning
`500`	Unexpected server error

Example request

Open this URL in the user's browser — it is a top-level redirect, not a call your code makes:

https://production-api.shoutaboutus.com/oauth/authorize?client_id=YOUR_CLIENT_ID&redirect_uri=https://yourapp.com/callback&response_type=code&scope=*&state=RANDOM_STRING