Sign in with Denpa — step 3: the user's decision

POST

/api/protocol/v1/auth/authorize

• Protocol hub (Next.js) — federation, writes, receipts, market context

Approve or deny. First-party session cookie and same-origin only — an app can never approve itself. Returns the redirect URL (?code=…&state=… or ?error=access_denied).

Authorizations

• sessionCookie

Request Body ^required

object

challengeId

required

string

decision

required

string

Allowed values: approve deny

Responses

200

Redirect

object

redirectUrl

string

401

unauthenticated

object

error

required

Stable machine-readable code (snake_case) or a short reason.

string

message

string

key

additional properties

any

403

Cross-origin refused

object

error

required

Stable machine-readable code (snake_case) or a short reason.

string

message

string

key

additional properties

any