---
id: "en/api-get-api-authorize-do"
title: "Authentication interface one (login callback method)"
language: "en"
description: "GET /api/authorize.do: Authentication interface one (login callback method) Interface description, including path, method, parameters and return information."
canonical_url: "https://www.babel.cc/public/babelwiki/en/api-get-api-authorize-do.html"
markdown_url: "https://www.babel.cc/public/babelwiki/ai/en/api-get-api-authorize-do.md"
alternates: {"en": "https://www.babel.cc/public/babelwiki/ai/en/api-get-api-authorize-do.md", "zh": "https://www.babel.cc/public/babelwiki/ai/zh/api-get-api-authorize-do.md"}
reading_note: "文档记录不等于当前部署能力；以实际版本、授权模块与配置为准。保留原文的可选、限制及待确认说明，勿补猜接口。 / Documentation is not a guarantee for every deployment. Preserve optional-module requirements, limitations and unresolved API contracts."
---

# Authentication by Login Callback

Open this endpoint in a browser to let the user sign in and authorize access. An access token is not required for this authorization entry point.

| Property | Value |
| --- | --- |
| Method | `GET` |
| Path | `/api/authorize.do` |

## URL Parameters

| Parameter | Type | Description |
| --- | --- | --- |
| `response_type` | string | Required; `code` |
| `client_id` | string | Required; developer application ID |
| `redirect_uri` | string | Required; must match the registered callback; URL-encode this parameter |
| `data` | string | Optional data returned with the callback; do not include secrets |

## Flow

1. Open the authorization URL with the required parameters.
2. Users sign in if needed and grant authorization.
3. The server redirects to `redirect_uri` with HTTP 302, carrying `code` and `data`.
4. Your server exchanges the code using [Get Token](https://www.babel.cc/public/babelwiki/en/api-post-api-token-do.html).

A code is valid for five minutes and becomes invalid after one use, including an unsuccessful exchange. Validate the callback against the originating session; a one-time random value in `data` can correlate the request. Use HTTPS and do not log complete authorization codes.

[JWT authorization](https://www.babel.cc/public/babelwiki/en/api-get-api-authorizebyjwt-do.html) is a separate flow. Do not mix its parameters with this flow.