Approve OAuth consent

Called by the Nomadfiling frontend after a user approves consent to issue a short-lived authorization code.

curl -X POST "https://api.example.com/mcp-server/approve" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_TOKEN (JWT)" \
  -d '{
  "client_id": "mcp_client_example_1234567890abcdef",
  "redirect_uri": "https://client.example.app/callback",
  "scope": "mcp",
  "code_challenge": "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
  "code_challenge_method": "S256"
}'

import requests
import json

url = "https://api.example.com/mcp-server/approve"
headers = {
  "Content-Type": "application/json",
  "Authorization": "Bearer YOUR_API_TOKEN (JWT)"
}
data = {
  "client_id": "mcp_client_example_1234567890abcdef",
  "redirect_uri": "https://client.example.app/callback",
  "scope": "mcp",
  "code_challenge": "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
  "code_challenge_method": "S256"
}

response = requests.post(url, headers=headers, json=data)
print(response.json())

const response = await fetch("https://api.example.com/mcp-server/approve", {
  method: "POST",
  headers: {
  "Content-Type": "application/json",
  "Authorization": "Bearer YOUR_API_TOKEN (JWT)"
},
  body: JSON.stringify({
  "client_id": "mcp_client_example_1234567890abcdef",
  "redirect_uri": "https://client.example.app/callback",
  "scope": "mcp",
  "code_challenge": "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
  "code_challenge_method": "S256"
})
});

const data = await response.json();
console.log(data);

package main

import (
    "fmt"
    "net/http"
    "bytes"
    "encoding/json"
)

func main() {
    data := []byte(`{
  "client_id": "mcp_client_example_1234567890abcdef",
  "redirect_uri": "https://client.example.app/callback",
  "scope": "mcp",
  "code_challenge": "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
  "code_challenge_method": "S256"
}`)

    req, err := http.NewRequest("POST", "https://api.example.com/mcp-server/approve", bytes.NewBuffer(data))
    if err != nil {
        panic(err)
    }

    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN (JWT)")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    fmt.Println("Response Status:", resp.Status)
}

require 'net/http'
require 'json'

uri = URI('https://api.example.com/mcp-server/approve')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true

request = Net::HTTP::Post.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN (JWT)'
request.body = '{
  "client_id": "mcp_client_example_1234567890abcdef",
  "redirect_uri": "https://client.example.app/callback",
  "scope": "mcp",
  "code_challenge": "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
  "code_challenge_method": "S256"
}'

response = http.request(request)
puts response.body

{
  "code": "mcp_code_example_1234567890abcdef"
}

POST

/approve

POST

Base URLstring

Target server for requests. Edit to use your own host.

Bearer Token (JWT)

Bearer Tokenstring

Required

User session JWT bearer token required for frontend consent approval.

Content-Typestring

Required

The media type of the request body

Options: application/json

client_idstring

Required

Registered OAuth client identifier.

redirect_uristring

Required

Redirect URI approved by the user.

Format: uri

scopestring

Approved scope. Defaults to mcp.

code_challengestring

PKCE code challenge value associated with the authorization request.

code_challenge_methodstring

PKCE code challenge method.

Options: S256, plain

Request Preview

Response

Response will appear here after sending the request

Authentication

header

Authorizationstring

Required

Bearer token (JWT). User session JWT bearer token required for frontend consent approval.

Body

application/json

client_idstring

Required

Registered OAuth client identifier.

Example:

mcp_client_example_1234567890abcdef

redirect_uristring

Required

Redirect URI approved by the user.

Example:

https://client.example.app/callback

scopestring

Approved scope. Defaults to mcp.

Example:

mcp

code_challengestring

PKCE code challenge value associated with the authorization request.

Example:

E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM

code_challenge_methodstring

PKCE code challenge method.

Allowed values:S256plain

Responses

codestring

Required

Short-lived authorization code with a 5-minute expiry.

Was this page helpful?