---
updatedAt: 2026-06-23T11:32:21.000Z
agentTools:
  projectIndex: https://docs.zeplin.dev/llms.txt
---

# Authorization endpoint

Users are redirected to web app to authenticate themselves and authorize the app with `client_id` to act on behalf of themselves.

# OpenAPI definition

```json
{
  "openapi": "3.0.2",
  "info": {
    "title": "Zeplin API",
    "description": "Access your resources in Zeplin",
    "version": "0.0.0",
    "contact": {
      "name": "Zeplin",
      "url": "https://zeplin.io",
      "email": "support@zeplin.io"
    }
  },
  "servers": [
    {
      "url": "https://api.zeplin.dev"
    }
  ],
  "security": [
    {
      "OAuth2": []
    }
  ],
  "paths": {
    "/v1/oauth/authorize": {
      "get": {
        "tags": [
          "Authorization"
        ],
        "summary": "Authorization endpoint",
        "description": "Users are redirected to web app to authenticate themselves and authorize the app with `client_id` to act on behalf of themselves.",
        "operationId": "OAuthAuthorize",
        "security": [],
        "x-readme": {
          "samples-languages": [
            "node",
            "curl",
            "python",
            "swift",
            "kotlin"
          ],
          "code-samples": [
            {
              "language": "node",
              "name": "sdk",
              "code": "import { ZeplinApi }  from \"@zeplin/sdk\";\n\nconst zeplin = new ZeplinApi();\n\nconst redirectUrl = zeplin.authorization.getAuthorizationUrl({\n  clientId: \"YOUR_CLIENT_ID\",\n  redirectUri: \"YOUR_REDIRECT_URI\",\n  state: \"YOUR_STATE\", // Optional\n  codeChallenge: \"YOUR_CODE_CHALLENGE\", // Optional\n  codeChallengeMethod: \"S256\" // or \"plain\" (optional)\n});\n"
            }
          ]
        },
        "parameters": [
          {
            "name": "response_type",
            "in": "query",
            "description": "Only `code` flow is supported",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "client_id",
            "in": "query",
            "description": "Identifier of the Zeplin app requesting user authentication",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "redirect_uri",
            "in": "query",
            "description": "User is redirected to this endpoint after authorization",
            "required": true,
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "state",
            "in": "query",
            "description": "RECOMMENDED. An opaque value used by the client to maintain state between the request and callback.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "code_challenge",
            "in": "query",
            "description": "RECOMMENDED. A PKCE code challenge derived from the code verifier, to be verified against later.",
            "schema": {
              "type": "string"
            }
          },
          {
            "name": "code_challenge_method",
            "in": "query",
            "description": "RECOMMENDED. PKCE code verifier transformation method.",
            "schema": {
              "type": "string",
              "enum": [
                "plain",
                "S256"
              ],
              "default": "S256"
            }
          }
        ],
        "responses": {
          "302": {
            "description": "User is redirected to web app for authorization"
          }
        }
      }
    }
  },
  "components": {
    "securitySchemes": {
      "OAuth2": {
        "type": "oauth2",
        "flows": {
          "authorizationCode": {
            "authorizationUrl": "/v1/oauth/authorize",
            "tokenUrl": "/v1/oauth/token",
            "refreshUrl": "/v1/oauth/token",
            "scopes": {}
          }
        }
      }
    }
  }
}
```