Error

A valid request URL is required to generate request examples

{
  "event_id": "<string>",
  "type": "<string>",
  "is_bifrost_error": true,
  "status_code": 123,
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "event_id": "<string>"
  },
  "extra_fields": {
    "model_requested": "<string>",
    "request_type": "<string>"
  }
}

OAuth

Authorization endpoint (OAuth 2.1)

OAuth 2.1 authorization endpoint. Validates the request parameters, creates a browser-bound PendingFlow record (15-minute TTL), and redirects the user to the Bifrost consent screen at /oauth/consent?flow_id=xxx.

PKCE is required - code_challenge and code_challenge_method=S256 must be provided. Plain code challenges are not supported.

A __bifrost_flow_secret HttpOnly SameSite=Lax cookie is set on redirect to bind the consent flow to the initiating browser session (CSRF protection).

Authentication is not required - this is part of the unauthenticated OAuth bootstrap flow.

GET

api

oauth

per-user

authorize

Error

A valid request URL is required to generate request examples

{
  "event_id": "<string>",
  "type": "<string>",
  "is_bifrost_error": true,
  "status_code": 123,
  "error": {
    "type": "<string>",
    "code": "<string>",
    "message": "<string>",
    "param": "<string>",
    "event_id": "<string>"
  },
  "extra_fields": {
    "model_requested": "<string>",
    "request_type": "<string>"
  }
}

Authorizations

Authorization

string

header

required

Bearer token authentication. Use your provider API key or Bifrost authentication token. Virtual keys (prefixed with sk-bf-) can also be passed here.

Query Parameters

response_type

enum<string>

required

Must be code

Available options:

code

client_id

string

required

Client ID obtained from the registration endpoint

redirect_uri

string

required

Must match a URI registered for this client

code_challenge

string

required

PKCE code challenge (Base64URL-encoded SHA-256 of the code verifier)

code_challenge_method

enum<string>

required

Must be S256

Available options:

S256

state

string

Opaque value to maintain state between request and callback (CSRF protection)

Response

Redirect to consent screen at /oauth/consent?flow_id=xxx

⌘I

Documentation Index

Authorizations

Query Parameters

Response