Skip to main content
GET
This is a browser redirect endpoint, not a JSON API call. Open this URL in the user’s browser. Don’t fetch it from a backend or CLI process and follow the redirect yourself, since the user has to see and approve the consent screen. The flow:
  1. The client opens /oauth/authorize in the user’s browser.
  2. Resend redirects (302) to the Resend dashboard consent screen, which handles login if needed.
  3. The user reviews and approves (or denies) the request.
  4. The dashboard redirects the browser back to the client’s redirect_uri with a code and the original state.

​
Query Parameters

​
string
required
The client_id from registration, or the HTTPS URL of a Client ID Metadata Document. Resend tells the two apart by the https:// prefix.
​
string
required
Must be "code".
​
string
required
Must exactly match one of the client’s registered redirect URIs. The only exception is loopback URIs (127.0.0.1, localhost, [::1]), where the port is allowed to differ from what was registered.
​
string
Space-delimited list of requested scopes. If omitted, defaults to the client’s full registered scope set.

​
Scopes

  • emails:send is enough for send-only routes: POST /emails, POST /email, POST /emails/sending, POST /email/sending, and POST /broadcasts/:broadcastId/send.
  • full_access is required for every other API route. Also satisfies any emails:send-scoped check.
​
string
An opaque value round-tripped back on the callback unchanged. Use it to bind the callback to the request that started the flow. Recommended, not required by the server, but a client that skips it can’t detect CSRF on the callback. Maximum 1024 characters.
​
string
required
Base64url-encoded SHA-256 hash of a code_verifier your client generates.
​
string
required
Must be "S256". Resend does not support the plain method.
A resource parameter (RFC 8707) is accepted but ignored. Resend does not support resource indicators yet.

​
Client ID Metadata Documents

A client_id that starts with https:// is read as the URL of a JSON document describing the client, so the client never registers. This follows the OAuth Client ID Metadata Document draft. This is the only endpoint that fetches the document. See Client ID Metadata Documents for the document fields and for how Resend fetches and caches it.

​
Errors

Before client_id and redirect_uri are validated (unknown client_id, invalid or unregistered redirect_uri), Resend returns a JSON error body, since it can’t safely redirect to an unvalidated URL. Once Resend validates client_id and redirect_uri, errors redirect (302) back to redirect_uri with error, error_description, and (if provided) state as query parameters only when the redirect_uri is trusted: a loopback address, a private-use URI scheme, or a verified client. An unverified https callback gets a JSON error body instead, which prevents the endpoint from being used as an open redirect. Handle both.