> ## Documentation Index > Fetch the complete documentation index at: https://nevermined.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Generate an OAuth 2.1 authorization code > Authorization Code flow with PKCE (mandatory). Mints an x402 payment permission for a specific agent and plan. Browser-initiated in the signed-in user's context — authenticated with the user's Nevermined API key (unauthenticated → BCK.OAUTH.0007). Requires a pre-registered client_id (unregistered → BCK.OAUTH.0016). ## OpenAPI ````yaml /api-reference/oauth-openapi.json post /oauth/authorize openapi: 3.0.0 info: title: Nevermined Authentication API description: >- The OAuth 2.1 + RFC 8628 device-flow ceremony and standards-based discovery endpoints an agent or connector uses to obtain and manage a Nevermined credential. These endpoints are root-mounted (not under /api/v1). version: 1.0.0 contact: {} servers: - url: https://api.sandbox.nevermined.app description: Sandbox - url: https://api.live.nevermined.app description: Live security: [] tags: - name: Authentication - Ceremony x-group: Ceremony description: Authorization Code (PKCE) and RFC 8628 device grant. - name: Authentication - Connections x-group: Connections description: AgentBindings — the consent receipts a user manages. - name: Authentication - Discovery x-group: Discovery description: RFC 8414 / 9728 / JWKS metadata. paths: /oauth/authorize: post: tags: - Authentication - Ceremony summary: Generate an OAuth 2.1 authorization code description: >- Authorization Code flow with PKCE (mandatory). Mints an x402 payment permission for a specific agent and plan. Browser-initiated in the signed-in user's context — authenticated with the user's Nevermined API key (unauthenticated → BCK.OAUTH.0007). Requires a pre-registered client_id (unregistered → BCK.OAUTH.0016). requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/AuthorizeRequest' responses: '201': description: Authorization code content: application/json: schema: $ref: '#/components/schemas/AuthorizeResponse' '400': $ref: '#/components/responses/Error' '401': $ref: '#/components/responses/Error' security: - bearerAuth: [] components: schemas: AuthorizeRequest: type: object required: - client_id - redirect_uri - code_challenge - code_challenge_method properties: client_id: type: string example: fleet description: Pre-registered OAuth client (connector). agent_id: type: string nullable: true example: agent-123 description: Target agent for the grant. Optional. resource: type: string nullable: true example: https://mcp-server.example.com description: >- RFC 8707 resource (audience) — SELECTS the credential type: this API's host → NVM API key; any other resource → x402 payment permission. Omit it and the binding decides (delegation-backed → x402 permission; plan-only → NVM API key). redirect_uri: type: string example: cursor://oauth/callback code_challenge: type: string example: E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM description: PKCE challenge (base64url SHA-256). code_challenge_method: type: string enum: - S256 example: S256 state: type: string nullable: true example: xyz description: CSRF protection. plan_id: type: string nullable: true example: '105906634574379352540220884472' description: Plan to authorize against. Optional. provider: type: string enum: - stripe - braintree - vgs nullable: true description: >- Account-level (account_access) spend mandate only: the card rail backing the cap. Plan-agnostic card providers only. All five spend-mandate fields are REQUIRED together for an account-level grant (partial presence → BCK.OAUTH.0026); they are ignored for an agent-specific grant. provider_payment_method_id: type: string nullable: true description: >- Account-level only: the enrolled card id backing the delegation. Part of the all-or-nothing spend-mandate set (see provider). spending_limit_cents: type: integer nullable: true minimum: 1 maximum: 100000000 example: 5000 description: >- Account-level only: cumulative spend cap in cents (smallest currency unit), 1..100000000 ($1,000,000 ceiling). This is where a cap is SET; its consumption surfaces later as AgentBindingSummary.spendingLimitCents / amountSpentCents. duration_secs: type: integer nullable: true minimum: 1 maximum: 31536000 example: 2592000 description: >- Account-level only: the spend cap's active window in seconds, 1..31536000 (1-year ceiling). currency: type: string enum: - usd - eur nullable: true description: >- Account-level only: the fiat currency of the spend cap. Card rails only — crypto codes are rejected. AuthorizeResponse: type: object properties: code: type: string example: abc123… description: Authorization code to exchange at /oauth/token. ErrorEnvelope: type: object properties: code: type: string example: BCK.OAUTH.0016 message: type: string example: Unknown OAuth client category: type: string enum: - validation - auth - business - integration - internal example: auth hint: type: string nullable: true retryable: type: boolean nullable: true description: When present, whether retrying the same request may succeed. httpStatus: type: integer example: 400 responses: Error: description: Typed error envelope content: application/json: schema: $ref: '#/components/schemas/ErrorEnvelope' securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: Nevermined API key description: >- A Nevermined API key: `Authorization: Bearer `. Environment-prefixed, not a bare JWT — send the whole string. ```` ## Related topics - [Authorization Code + PKCE](/docs/integrate/authentication/oauth-authorization-code.md) - [API error codes](/docs/development-guide/api-errors/codes.md) - [RFC 8628 device authorization request](/docs/api-reference/authentication--ceremony/rfc-8628-device-authorization-request.md) - [Authorization Server Metadata (RFC 8414)](/docs/api-reference/authentication--discovery/authorization-server-metadata-rfc-8414.md) - [Approve or deny a device authorization](/docs/api-reference/authentication--ceremony/approve-or-deny-a-device-authorization.md)