Skip to main content
GET
URL

Query Parameters

response_type
enum<string>
required

Always code.

Available options:
code
client_id
string
required

The client's ID: a platform's platform.client_id from GET /v1/account, a client_id from POST /oauth/register, or the HTTPS URL of the client's metadata document.

redirect_uri
string<uri>
required

Where Reflections sends the person back. It must equal one of the client's registered redirect URIs.

scope
string
required

Space-separated scopes. A platform asks for connection scopes, and an MCP client for MCP scopes. Ask only for what you use.

state
string
required

An unguessable value you keep with the person's session. It comes back unchanged; reject a redirect whose state you did not send.

Required string length: 16 - 512
code_challenge
string
required

The PKCE challenge, BASE64URL(SHA-256(code_verifier)) without padding.

Required string length: 43
code_challenge_method
enum<string>
required

Always S256.

Available options:
S256
resource
string<uri>

The resource the token will be used at, as RFC 8707 defines. MCP clients send https://app.reflections.ai/mcp. Platforms leave it out.

Response

Redirects to redirect_uri. After an approval the query carries code, state and iss. After a decline or a request Reflections cannot accept, it carries error, an optional error_description, state and iss. error is access_denied (the person declined), invalid_scope (a scope the client may not ask for), invalid_request (a missing or malformed parameter, including PKCE), unsupported_response_type, server_error or temporarily_unavailable.