Skip to main content
GET
Create a short-lived authorization request and redirect the user to the VoiceCheap sign-in and permission-consent page.

​
Authentication

None on this route. The browser’s subsequent consent flow requires the user to sign in, and approval requires eligible paid account access.

​
Query parameters

​
string
required
The client_id returned by dynamic registration, or the exact public HTTPS URL of the client metadata document.Minimum length: 1. Maximum length: 2048. Pattern: ^[^\u0000-\u001F\u007F]+$.
​
string
required
Must exactly match one of this client’s registered redirect_uris.Minimum length: 1. Maximum length: 2048. Pattern: ^[^\u0000-\u001F\u007F]+$.
​
field
required
Value defined by the complete input schema.Required value: “code”.
​
field
Value defined by the complete input schema.Required value: “query”. Default: “query”.
​
string
required
Base64url SHA-256 digest of the original code_verifier, without padding.Minimum length: 43. Maximum length: 43. Pattern: ^[A-Za-z0-9_-]{43}$.
​
field
required
Value defined by the complete input schema.Required value: “S256”.
​
string
required
Required exact resource audience: use the resource value from this environment’s protected-resource metadata. In production this is https://api.voicecheap.ai/mcp. A different origin, path, or trailing slash is rejected.Format: “uri”.
​
string
Space-delimited permissions from scopes_supported, optionally including offline_access. Unsupported names and whitespace-only values are rejected; duplicates are removed. Omitting scope or supplying no product scopes, such as openid alone or offline_access alone, selects the default read scopes intersected with this client’s registered product scopes. email requires openid; email alone is rejected. Requested product permissions must be registered for this client. Identity permissions must be explicitly requested and approved by the user; omitting scope requests no identity permissions.Minimum length: 1. Maximum length: 2048. Pattern: ^ *(?:account:read|usage:read|settings:read|settings:write|team:read|team:write|projects:read|projects:write|projects:delete|translations:write|transcription:read|transcription:write|subtitles:read|subtitles:write|tts:read|tts:write|voices:read|voices:write|images:read|images:write|thumbnails:read|thumbnails:write|folders:read|folders:write|glossary:read|glossary:write|webhooks:read|webhooks:write|publishing:read|publishing:write|offline_access|openid|email)(?: +(?:account:read|usage:read|settings:read|settings:write|team:read|team:write|projects:read|projects:write|projects:delete|translations:write|transcription:read|transcription:write|subtitles:read|subtitles:write|tts:read|tts:write|voices:read|voices:write|images:read|images:write|thumbnails:read|thumbnails:write|folders:read|folders:write|glossary:read|glossary:write|webhooks:read|webhooks:write|publishing:read|publishing:write|offline_access|openid|email))* *$.
​
string
Optional opaque value echoed on the final callback. Use a fresh unpredictable value and verify it in the client.Minimum length: 1. Maximum length: 2048. Pattern: ^[^\u0000-\u001F\u007F]+$.
​
string
Optional opaque nonce echoed in the ID token when openid is granted. Verify it in the client.Minimum length: 1. Maximum length: 2048. Pattern: ^[^\u0000-\u001F\u007F]+$.
​
string
Text value.Required value: “consent”.

​
Request examples

Follow the documented encoding and authentication for this route. The action API’s envelope and idempotency rules apply only to action invocations.

​
Response

HTTP redirect to the VoiceCheap consent page. There is no JSON result body. The Location contains an opaque request value; the user then signs in and chooses permissions.

​
Response headers

​
Operation notes

  • Recognized scalar parameters must be supplied once as nonempty strings without ASCII control characters or DEL. Repeated query/form fields decode to arrays and are rejected when read as scalars.
  • URL-encode every query value. The redirect_uri must use exactly the spelling registered for this client.
  • Use S256 only; plain PKCE and implicit/token responses are unsupported. Retain the original 43–128-character code_verifier for the token exchange.
  • The resource parameter is mandatory and must exactly equal the selected environment’s MCP resource URL.
  • The default product scope set is account:read usage:read projects:read transcription:read subtitles:read tts:read voices:read images:read thumbnails:read. A defaulted request is narrowed to scopes registered by the client; if no product scopes remain, authorization fails.
  • A scope consisting only of offline_access uses the default product scope selection. offline_access is removed before showing or granting product permissions.
  • Consent requests expire after 10 minutes and can be answered once. The user may approve only a nonempty subset of the requested product permissions.
  • After approval, the client callback receives code, iss, and the original state when supplied. The authorization code expires after 2 minutes and can be exchanged once.
  • After denial, the client callback receives error=access_denied, error_description, iss, and the original state when supplied; no code is issued.
  • Invalid client metadata, redirect mismatches, PKCE, scopes, or resource produce OAuth JSON errors directly; they are not redirected to an unvalidated callback.
  • The public authorization limit is 30 requests per minute per client IP, shared across workers.
  • openid and email are identity permissions, separate from product permissions, and are accepted only when advertised. email requires openid. During initial authorization, a request containing only identity scopes uses the default product permissions shown on the consent screen.
  • The client_id returned by dynamic registration, or the exact public HTTPS URL of the client metadata document.
  • For OpenID Connect, prompt=consent is supported. Other prompt values and max_age are rejected; silent authorization and forced fresh sign-in are not supported.

​
Errors