Authorize User

Send the user's browser to this URL to start the OAuth 2.1 authorization code flow with PKCE. The user signs in, sees the consent screen for the scopes you asked for, and approves. Panda IDX then redirects to your redirect_uri with a one-time code. OAuth tokens work with the Panda IDX MCP servers only; the Site API uses a public key and needs no OAuth.

GET/authorize

Authentication

Noneno credentials

No credentials. This is a browser redirect. The client_id comes from Dynamic Client Registration (POST /register) or is the HTTPS URL of a Client ID Metadata Document. Only users who own or administer a Panda IDX account can approve.

Query Parameters

response_typestring

required

Must be code.

Default:code

client_idstring

required

The client_id returned by POST /register, or the HTTPS URL of your Client ID Metadata Document.

redirect_uristring

required

Must match one of the redirect URIs registered for the client.

scopestring

required

Space or comma separated scopes. See the scope list below.

Default:profile listings

resourcestring

required

The protected resource the token is for. It must be the Panda IDX MCP server.

Default:https://api.pandaidx.com/mcp

code_challengestring

required

PKCE challenge: base64url(SHA-256(code_verifier)). Required for public clients (token_endpoint_auth_method none).

code_challenge_methodstring

required

Must be S256.

Default:S256

statestring

optional

Opaque value for CSRF protection. Returned unchanged in the callback.

Response

302 Redirect to your callback

After the user approves, Panda IDX redirects the browser to your redirect_uri with a one-time authorization code (valid for a few minutes). If the user denies, you receive error=access_denied instead.

{{redirect_uri}}?code=AUTHORIZATION_CODE&state={{state}}&iss=https://app.pandaidx.com

codeOne-time authorization code. Exchange it at POST /api/oauth/token together with your code_verifier.

stateThe value you sent. Verify it matches to prevent CSRF.

issThe issuer, https://app.pandaidx.com. Verify it to prevent mix-up attacks (RFC 9207).

Request

# Build the URL and open it in the user's browser
AUTH_URL="https://app.pandaidx.com/authorize?\
response_type=code&\
client_id={{client_id}}&\
redirect_uri={{redirect_uri}}&\
scope=profile%20listings%20contacts&\
resource=https%3A%2F%2Fapi.pandaidx.com%2Fmcp&\
code_challenge={{code_challenge}}&\
code_challenge_method=S256&\
state={{state}}"

echo $AUTH_URL

Response302 Redirect

{{redirect_uri}}?code=AUTHORIZATION_CODE&state={{state}}&iss=https://app.pandaidx.com