> ## Documentation Index
> Fetch the complete documentation index at: https://tabillo.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Authorization Page

> Redirect the user here to begin the OAuth 2.0 Authorization Code flow. Returns an HTML page — not JSON. After the user approves, they are redirected to your `redirect_uri` with a `code` parameter.




## OpenAPI

````yaml GET /oauth/authorize
openapi: 3.1.0
info:
  title: Tabillo API
  version: 1.0.0
  description: >
    External REST API for Tabillo workspaces. Authenticate using an API key
    generated in Settings → API Keys (admin only).
  contact:
    email: support@tabillo.com
servers:
  - url: https://crossproductroadmapbackend.vercel.app/api/v1
    description: Production
security:
  - ApiKeyAuth: []
  - OAuthBearer: []
paths:
  /oauth/authorize:
    get:
      tags:
        - OAuth
      summary: OAuth Authorization Page
      description: >
        Redirect the user here to begin the OAuth 2.0 Authorization Code flow.
        Returns an HTML page — not JSON. After the user approves, they are
        redirected to your `redirect_uri` with a `code` parameter.
      parameters:
        - name: client_id
          in: query
          required: true
          schema:
            type: string
        - name: redirect_uri
          in: query
          required: true
          schema:
            type: string
        - name: response_type
          in: query
          required: true
          schema:
            type: string
            enum:
              - code
        - name: state
          in: query
          schema:
            type: string
        - name: scope
          in: query
          schema:
            type: string
            example: read write
        - name: code_challenge
          in: query
          schema:
            type: string
          description: PKCE SHA-256 code challenge (base64url encoded)
        - name: code_challenge_method
          in: query
          schema:
            type: string
            enum:
              - S256
      responses:
        '200':
          description: HTML authorization page
      security: []
components:
  securitySchemes:
    ApiKeyAuth:
      type: http
      scheme: bearer
      bearerFormat: tab_<32 alphanumeric chars>
      description: >
        Generate an API key in your workspace Settings → API Keys. Pass it as
        `Authorization: Bearer tab_<key>` on every request.
    OAuthBearer:
      type: http
      scheme: bearer
      bearerFormat: tabt_<32 alphanumeric chars>
      description: >
        OAuth 2.0 access token obtained via the Authorization Code flow. Pass it
        as `Authorization: Bearer tabt_<token>` on every request. Tokens expire
        after 1 hour; use the refresh token to obtain a new one.

````