Step 1: Send the user to sign in

get

https://production-api.shoutaboutus.com/oauth/authorize

Start the OAuth 2.0 authorization-code flow by sending the user's browser to the Shout About Us sign-in page. The user signs in with their Shout About Us email and password on our page, then approves your app. When they approve, we redirect the browser to your redirect_uri with a one-time code, which your server exchanges for a token in Step 3. This is a browser navigation, not an API call your server makes. This path is at the server root, not under /api/v1.

Prerequisites: app credentials (a client_id and at least one registered redirect URL) from the dashboard's API Keys page, and a random state value stored in the user's session.

Authentication: Public (no token). The user authenticates on our sign-in page; accounts that must use single sign-on, locked accounts and platform administrator accounts are refused there. The first time a user authorizes your app, they see an approval screen.

The sign-in form it redirects to (POST /oauth/login) is limited to 10 requests per minute per IP address, and it locks an account after repeated failed passwords.

Rate limit: none.

Recent Requests

Time	Status	User Agent
Retrieving recent requests…

Loading…

Query Params

client_id

string

required

Defaults to YOUR_CLIENT_ID

Required. Your app's client ID.

redirect_uri

string

Defaults to https://yourapp.com/callback

Where to send the user afterwards. It must match one of your registered redirect URLs exactly. Required when your app has more than one registered URL; send it every time so the value is explicit.

response_type

string

enum

required

Defaults to code

Required. Always code.

Allowed:

state

string

Defaults to RANDOM_STRING

A random value. We return it unchanged in Step 2 so you can confirm the response belongs to a request you started. The server doesn't require it.

scope

string

Defaults to *

Leave it out. Named scopes aren't defined; any value other than * returns invalid_scope, and * has no effect on this flow.

code_challenge

string

Defaults to E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM

PKCE challenge. Optional, because app credentials from the dashboard are confidential clients. If you send it, send code_verifier in Step 3.

code_challenge_method

string

enum

Defaults to S256

S256 or plain. Defaults to plain when a code_challenge is sent.

Allowed:

prompt

string

enum

Defaults to consent

login forces the user to sign in again, consent forces the approval screen, and none fails with login_required or consent_required instead of showing either.

Allowed:

Responses

Language

URL

Loading…

Response

Click Try It! to start a request and see the response here! Or choose an example:

*/*

application/json

302Redirect to the sign-in page, or to your redirect_uri with code and state (or with error, error_description, hint, state).

400client_id is missing, or a PKCE parameter is invalid.

401The client is unknown, or redirect_uri doesn't match a registered URL.

500Unexpected server error.