# Start authorization

Redirects the merchant's browser to the consent page for your app's scopes.

```http
GET https://larm.sa/oauth/authorize
```

This URL is opened by the **browser**, not by your server. Build the URL on your server, then redirect to it. The full walkthrough with PKCE is in [OAuth 2.0 with PKCE](/guides/authentication).

## Query parameters

| Field | Type | Required | Description |
|---|---|---|---|
| `response_type` | object | yes |  |
| `client_id` | string (uuid) | yes |  |
| `store_id` | string (uuid) | yes | From larm_store_id in the launch URL. |
| `redirect_uri` | string (uri) | yes | Exact match of a URL registered in the version. |
| `state` | string | yes |  |
| `code_challenge` | string | yes |  |
| `code_challenge_method` | object | yes |  |
| `scope` | string | yes | Space-separated, including all of their dependencies. |
| `version_id` | string (uuid) | no |  |


## Example request

```http
GET https://larm.sa/oauth/authorize
  ?response_type=code
  &client_id=$CLIENT_ID
  &store_id=$STORE_ID
  &redirect_uri=https%3A%2F%2Fapp.example.com%2Flarm%2Fcallback
  &state=$STATE
  &code_challenge=$CODE_CHALLENGE
  &code_challenge_method=S256
  &scope=products%3Aread%20orders%3Aread

HTTP/1.1 303 See Other
Location: https://store.example/dashboard/apps/consent?ticket=…&state=…
```


## Errors

| HTTP | Code | Meaning |
|---|---|---|
| 400 | `REDIRECT_URI_MISMATCH` | The URL is not registered in the version. |
| 400 | `SCOPE_DEPENDENCIES_MUST_BE_VISIBLE` | A scope was requested without its dependencies. |
| 403 | `INVALID_REQUESTED_SCOPES` | Scopes outside the version, or required scopes missing. |
| 403 | `PLAN_NOT_ELIGIBLE` | The store's plan does not include apps. |
| 429 | `AUTHORIZE_RATE_LIMITED` | Too many authorization requests. |