Skip to main content
Initiate the OAuth 2.0 authorization code flow. Redirect users to this endpoint so they can authenticate with their DHMAD account and grant your application access. After the user authorizes, they are redirected back to your redirect_uri with an authorization code.

​
Query Parameters

​
string
required
Your OAuth client ID (from the Developer Dashboard)
​
string
required
Must exactly match one of your registered redirect URIs. Must include a path (e.g., https://example.com/callback).
​
string
required
Must be code (only authorization code flow is supported)
​
string
required
A unique, random value generated per request. DHMAD returns this value unchanged in the callback so you can validate it to prevent CSRF attacks. Requests without state are rejected.
​
string
Space-separated list of scopes. Available: openid, profile, email. Defaults to openid profile email.
​
string
PKCE code challenge (base64url-encoded SHA-256 hash of your code verifier). Recommended for all clients.
​
string
Must be S256. The plain method is not accepted.

​
Example Request

​
Success Response

The user is redirected to your redirect_uri with:
​
string
Authorization code to exchange for tokens (expires in 10 minutes, single-use)
​
string
The same state value you provided — validate it matches your stored value

​
Error Response

If the user denies access:

​
Direct Error Responses (before redirect)

Missing required parameters:
Invalid client:
Invalid redirect URI:
Unsupported PKCE method:
If the user is not logged in, they are redirected to the DHMAD login page first, then returned to the consent screen. After granting access, they are redirected to your redirect_uri.