OAuth Server
Continue authorization after login
Called by your login UI once the user has signed in. Attaches the authenticated user to the authorization request and returns the URL of the consent screen to navigate to next. Bound to the live session with an access token and a DPoP proof — the Web SDK issues this call for you.
POST
/
v1
/
session
/
oauth
/
continue
Continue authorization after login
curl --request POST \
--url https://{appId}.session.prelude.dev/v1/session/oauth/continue \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'DPoP: <api-key>' \
--data '
{
"oauth_req": "oar_01jqebhswje1ka1z7ahr9rfsgt"
}
'import requests
url = "https://{appId}.session.prelude.dev/v1/session/oauth/continue"
payload = { "oauth_req": "oar_01jqebhswje1ka1z7ahr9rfsgt" }
headers = {
"Authorization": "Bearer <token>",
"DPoP": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
Authorization: 'Bearer <token>',
DPoP: '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({oauth_req: 'oar_01jqebhswje1ka1z7ahr9rfsgt'})
};
fetch('https://{appId}.session.prelude.dev/v1/session/oauth/continue', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{appId}.session.prelude.dev/v1/session/oauth/continue",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'oauth_req' => 'oar_01jqebhswje1ka1z7ahr9rfsgt'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json",
"DPoP: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{appId}.session.prelude.dev/v1/session/oauth/continue"
payload := strings.NewReader("{\n \"oauth_req\": \"oar_01jqebhswje1ka1z7ahr9rfsgt\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("DPoP", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://{appId}.session.prelude.dev/v1/session/oauth/continue")
.header("Authorization", "Bearer <token>")
.header("DPoP", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"oauth_req\": \"oar_01jqebhswje1ka1z7ahr9rfsgt\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{appId}.session.prelude.dev/v1/session/oauth/continue")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["DPoP"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"oauth_req\": \"oar_01jqebhswje1ka1z7ahr9rfsgt\"\n}"
response = http.request(request)
puts response.read_body{
"redirect_url": "https://auth.example.com/oauth/consent?oauth_req=oar_01jqebhswje1ka1z7ahr9rfsgt"
}{
"code": "bad_request",
"type": "bad_request"
}{
"code": "unauthorized",
"type": "unauthorized"
}{
"code": "internal",
"type": "internal"
}Authorizations
Access token obtained from session refresh
DPoP proof JWT (RFC 9449) bound to the calling session's key. Required
alongside the access token on the OAuth login-UI endpoints
(/oauth/continue, /oauth/pending, /oauth/decision). The Web SDK
constructs and rotates this proof for you.
Body
application/json
The authorization request id from the /authorize redirect.
Example:
"oar_01jqebhswje1ka1z7ahr9rfsgt"
Response
OK
The URL the browser should navigate to next.
Example:
"https://auth.example.com/oauth/consent?oauth_req=oar_01jqebhswje1ka1z7ahr9rfsgt"
⌘I
Continue authorization after login
curl --request POST \
--url https://{appId}.session.prelude.dev/v1/session/oauth/continue \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--header 'DPoP: <api-key>' \
--data '
{
"oauth_req": "oar_01jqebhswje1ka1z7ahr9rfsgt"
}
'import requests
url = "https://{appId}.session.prelude.dev/v1/session/oauth/continue"
payload = { "oauth_req": "oar_01jqebhswje1ka1z7ahr9rfsgt" }
headers = {
"Authorization": "Bearer <token>",
"DPoP": "<api-key>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {
Authorization: 'Bearer <token>',
DPoP: '<api-key>',
'Content-Type': 'application/json'
},
body: JSON.stringify({oauth_req: 'oar_01jqebhswje1ka1z7ahr9rfsgt'})
};
fetch('https://{appId}.session.prelude.dev/v1/session/oauth/continue', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{appId}.session.prelude.dev/v1/session/oauth/continue",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'oauth_req' => 'oar_01jqebhswje1ka1z7ahr9rfsgt'
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json",
"DPoP: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{appId}.session.prelude.dev/v1/session/oauth/continue"
payload := strings.NewReader("{\n \"oauth_req\": \"oar_01jqebhswje1ka1z7ahr9rfsgt\"\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("DPoP", "<api-key>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://{appId}.session.prelude.dev/v1/session/oauth/continue")
.header("Authorization", "Bearer <token>")
.header("DPoP", "<api-key>")
.header("Content-Type", "application/json")
.body("{\n \"oauth_req\": \"oar_01jqebhswje1ka1z7ahr9rfsgt\"\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{appId}.session.prelude.dev/v1/session/oauth/continue")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["DPoP"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"oauth_req\": \"oar_01jqebhswje1ka1z7ahr9rfsgt\"\n}"
response = http.request(request)
puts response.read_body{
"redirect_url": "https://auth.example.com/oauth/consent?oauth_req=oar_01jqebhswje1ka1z7ahr9rfsgt"
}{
"code": "bad_request",
"type": "bad_request"
}{
"code": "unauthorized",
"type": "unauthorized"
}{
"code": "internal",
"type": "internal"
}