# Get authorization code

Request for an authorization code from our authorization server. You will need to mention which scopes you need permission for. We will display the required permissions to the user. If the user grants permission, an authorization code will be sent to the redirect URL, which is valid for 2 minutes.

## Query parameters

| Parameter | Description |
|---|---|
| `client_id` | **required**<br><br>The unique ID of your application. You can find this in the [API console](https://api-console.zoho.com/). |
| `response_type` | **required**<br><br>Should be sent with the value `code`. |
| `redirect_uri` | **required**<br><br>The URI to which the authorization server will redirect the browser back with the authorization code. It has to be the same URI which is provided when registering the app in the API console. Should start with http:// or https://.<br><br>For example: `https://www.zylker.com/oauthredirect` |
| `scope` | **required**<br><br>The corresponding scope for the resource you want to access from the user's account. The scopes will be displayed to the user when asking for consent.<br><br>For example: `ZohoCRM.settings.READ` |
| `code_challenge_method` | **required**<br><br>The method used to transform the `code_verifier` into `code_challenge`. Must be either `S256` or `plain`.<br><br>Default value: `plain` |
| `code_challenge` | **required**<br><br>A string that is generated when `code_verifier` is transformed using the `code_challenge_method`. |
| `access_type` | **optional**<br><br>Determines whether your app can refresh the access token on its own once the access token expires (without user intervention). If the value is `online`, only the access token will be provided and it cannot be refreshed by the app once expired. If the value is `offline`, a refresh token will also be provided for the first time the app requests for an access token, which the app can store and then use to refresh the access token whenever required.<br><br>Default value: `online` |
| `prompt` | **optional**<br><br>If this parameter is included, the user will be prompted for consent every time your app requests access to the resource. If not included, the user will be prompted only the first time. The value must be `consent`. |

## Response parameters

After authenticating the user, we will display to the user what are all the permissions your app is requesting. Once the user grants permission, the authorization code will be sent to the `redirect_uri`.

| Parameter | Description |
|---|---|
| `code` | The authorization code that can be exchanged for an access token. Its validity is **two minutes** and can be used only once. |
| `location` | Indicates the data center (DC) location of the user (i.e., where their account is stored). If the user's DC is different from that of your app, then you will need to enable [multi DC support](https://www.zoho.com/accounts/protocol/oauth/multi-dc.html) and make the access token request to the user's DC. |

## Endpoint

```
GET     {accounts-server-url}/oauth/v2/auth
```

Note: The [accounts-server-url](https://accounts.zoho.com/oauth/serverinfo) is specific to the location (i.e., datacenter) where your app is registered.

## Request example

```curl
https://accounts.zoho.com/oauth/v2/auth 
?response_type=code 
&client_id=1000.GMB0YULZHJK411284S8I5GZ4CHUEX0 
&scope=AaaServer.profile.Read 
&redirect_uri=https://www.zylker.com/oauthredirect 
&code_challenge_method=S256
&code_challenge=cyBsZfGoX8dFwP-JVpT4U6MkDLrb8ZWGMdpBQtHsZPY
&access_type=offline 
&prompt=consent
```

## Response example

```curl
https://www.zylker.com/oauthredirect
?code=1000.a1110799eac53c491fee9efef8246535.df7da86ff64daa66413e2899e9b7fad7
&location=in
```