> ## Documentation Index
> Fetch the complete documentation index at: https://guide.mylifenote.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Authorize (browser step)

> Opens in the user's browser. Parameters are validated first, then: if the user has no Life Note web session they are redirected (302) to the login page and return here after sign-in; otherwise an HTML consent page is shown. When the user clicks Allow, the browser is redirected (302) to `redirect_uri?code=<code>&state=<state>`; on Not now, to `redirect_uri?error=access_denied&state=<state>`. The consent decision itself is a same-origin form POST to this path (fields `transaction_id`, `csrf_token`, `decision`) that is not meant to be called by integrations.

The `client_id` must belong to a client registered via `POST /oauth/register` (RFC 7591 dynamic registration, public clients, ids start with `agc_`) and `redirect_uri` must exactly match one registered URI (HTTPS, or http on localhost/127.0.0.1). The authorization code is valid for 5 minutes and single use.



## OpenAPI

````yaml /api-reference/openapi.json get /oauth/authorize
openapi: 3.1.0
info:
  title: Life Note Agent API
  version: 1.0.0
  description: >-
    Read-only HTTP API for connecting AI agents and automation tools (such as
    Zapier) to a user's Life Note account. Authenticate with OAuth 2.0
    authorization code + PKCE (S256) and send the access token as
    `Authorization: Bearer <access_token>`. Journal content is decrypted
    server-side and returned only to the authorizing user's own token.
servers:
  - url: https://mylifenote.ai/api/agent/v1
    description: Production
security: []
tags:
  - name: OAuth
    description: Authorization and token exchange
  - name: Account
  - name: Journal
paths:
  /oauth/authorize:
    get:
      tags:
        - OAuth
      summary: Authorize (browser step)
      description: >-
        Opens in the user's browser. Parameters are validated first, then: if
        the user has no Life Note web session they are redirected (302) to the
        login page and return here after sign-in; otherwise an HTML consent page
        is shown. When the user clicks Allow, the browser is redirected (302) to
        `redirect_uri?code=<code>&state=<state>`; on Not now, to
        `redirect_uri?error=access_denied&state=<state>`. The consent decision
        itself is a same-origin form POST to this path (fields `transaction_id`,
        `csrf_token`, `decision`) that is not meant to be called by
        integrations.


        The `client_id` must belong to a client registered via `POST
        /oauth/register` (RFC 7591 dynamic registration, public clients, ids
        start with `agc_`) and `redirect_uri` must exactly match one registered
        URI (HTTPS, or http on localhost/127.0.0.1). The authorization code is
        valid for 5 minutes and single use.
      operationId: authorize
      parameters:
        - name: response_type
          in: query
          required: true
          schema:
            type: string
            enum:
              - code
        - name: client_id
          in: query
          required: true
          description: Registered client id (starts with `agc_`, max 120 chars).
          schema:
            type: string
          example: agc_EXAMPLEclientIdOnly
        - name: redirect_uri
          in: query
          required: true
          description: Must exactly match a redirect URI registered for the client.
          schema:
            type: string
            format: uri
          example: https://client.example.com/oauth/callback
        - name: scope
          in: query
          required: true
          description: >-
            Space-separated list. Supported: `journal:read`, `chat:read`. At
            least one is required; unknown scopes are rejected.
          schema:
            type: string
          example: journal:read
        - name: state
          in: query
          required: false
          description: >-
            Opaque value echoed back unmodified on the redirect. Strongly
            recommended for CSRF protection.
          schema:
            type: string
        - name: code_challenge
          in: query
          required: true
          description: 'PKCE challenge: BASE64URL(SHA256(code_verifier)) without padding.'
          schema:
            type: string
          example: E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM
        - name: code_challenge_method
          in: query
          required: false
          description: Only `S256` is accepted. Defaults to `S256` when omitted.
          schema:
            type: string
            enum:
              - S256
            default: S256
      responses:
        '200':
          description: HTML consent page (user is signed in).
          content:
            text/html:
              schema:
                type: string
        '302':
          description: >-
            Redirect to the login page (no web session), or, after the consent
            POST, to `redirect_uri` with `code` and `state` (or
            `error=access_denied`).
          headers:
            Location:
              schema:
                type: string
        '400':
          description: >-
            Invalid request. JSON body. `error` is one of
            `unsupported_response_type`, `invalid_request`, `invalid_client`,
            `invalid_scope`. The user is not redirected back to the client in
            these cases.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Error'
              example:
                error: invalid_request
                detail: PKCE required (code_challenge + S256)
      security: []
components:
  schemas:
    Error:
      type: object
      required:
        - error
      properties:
        error:
          type: string
          description: Machine-readable code.
        detail:
          type: string
          description: Human-readable detail; not always present.

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.