# Authorize

## GET /api-gw/oauth/authorize

Authorize

First step of the OAuth 2.0 authorization flow for **third-party app** registrations. Redirects the user's browser to the Tradejini login page. After the user logs in, their browser is redirected to your `redirect_uri` with an authorization `code` in the query string. Pass that code to `POST /api-gw/oauth/token` to obtain an access token.

**Use this flow when:** your app authenticates on behalf of multiple Tradejini user accounts.

**Prerequisite:** [Create an app](https://developer.tradejini.com/developer-portal) in the Apps Section to obtain your `client_id` (API key) and `client_secret`.

**Note:** This endpoint performs a browser redirect and cannot be tested directly in this playground. See the authentication curl examples in the API overview.

### Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| client_id | query | string | Yes | Your app's alphanumeric API key from the [Apps Section](https://developer.tradejini.com/developer-portal) app registration page. If the value does not match the registered app, authorization will be denied. |
| redirect_uri | query | string | Yes | The callback URL registered in your app on the [Apps Section](https://developer.tradejini.com/developer-portal). Must match exactly — if it does not, authorization will be denied. |
| response_type | query | string ("code") | Yes | As per oAuth specification this value should be __"code"__ |
| scope | query | string ("general") | Yes | This field value should be __"general"__. |
| state | query | string | Yes | A literal string that will be return in the final redirection callback. |

### Responses

#### 302 — Redirect to login page or redirect url with code.

#### 400 — Bad inputs

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| s | string ("error") | No | Response status. Always `error` for error responses. |
| msg | string ("Unauthorized") | No | Error message. |

#### 401 — Unauthorized — wrong `client_id`, password, or 2FA value. Verify credentials and ensure `twoFaTyp` matches the 2FA value type.

| Field | Type | Required | Description |
| --- | --- | --- | --- |
| s | string ("error") | No | Response status. Always `error` for error responses. |
| msg | string ("Unauthorized") | No | Error message. |