ChartnautDocs

Start an authorization

GET/oauth/authorize

Starts an OAuth authorization. Open it in the person's browser: Chartnaut checks the request and sends them to its consent page, and when they click Allow it redirects to your redirect_uri with a one-time code for Get a token.

Scope

Heavy call

Long poll

CLI

None, no key

No

No

None

Guidance

  • It lives at the root of https://api.chartnaut.com, not under /v1. Open it in a browser, never with a background request: the person signs in and decides on https://terminal.chartnaut.com/morpheus/oauth/consent. Permissions and connected apps shows that page.

  • PKCE is required. Make a random code_verifier of 43 to 128 characters, send its SHA-256, base64url-encoded without padding, as code_challenge, and keep the verifier for the token call.

  • Check that state comes back unchanged, and that iss is https://api.chartnaut.com.

  • The request lasts 10 minutes and can be answered once. The code lasts 60 seconds and works once; a second use revokes every token the first one issued.

  • Allow needs Starter or above. On Free, the consent page shows API access is included on Starter and above and nothing is redirected until the person upgrades or clicks Cancel.

  • Limited to 60 a minute from one IP address.

Query parameters

Name

Type

Required

Default

Description

response_type

string

Yes

None

code

client_id

string

Yes

None

From Register a client

redirect_uri

string

When more than one is registered

The only registered one

Must match a registered URI exactly. For http loopback URIs, only the port can differ

code_challenge

string

Yes

None

The PKCE challenge, 43 to 128 characters

code_challenge_method

string

Yes

None

S256

state

string

No

None

Returned unchanged. Up to 2,000 characters

scope

string

No

All three

Space-separated: scripts:read, scripts:write, runs:write

resource

string

No

The MCP server

https://api.chartnaut.com/v1/mcp, the only resource tokens are issued for

Response

302 to the consent page. After the person decides, their browser goes to your redirect_uri with these query parameters:

Parameter

When

Description

code

Allow

64 hex characters. Exchange it within 60 seconds

error

Cancel or a bad request

access_denied, invalid_request, invalid_scope, invalid_target or unsupported_response_type

error_description

With error

For people

state

Always, when sent

Your state

iss

Always

https://api.chartnaut.com

After Allow, the browser arrives at your redirect_uri like this:

http://127.0.0.1:33418/callback?code=8f14e45fceea167a5a36dedd4bea2543c9f0f895fb98ab9159f51fd0297e236d&iss=https%3A%2F%2Fapi.chartnaut.com&state=af0ifjsldkj

A request whose client_id or redirect_uri cannot be trusted is never redirected. Chartnaut shows an error page instead, This sign-in link can't be used, with the reason.

Status codes

Status

Code

Meaning

302

-

To the consent page, or to your redirect_uri with an error

400

invalid_client

Unknown client_id: register again. Shown as a page

400

invalid_request

Missing client_id, or a redirect_uri that is missing or not registered. Shown as a page

429

-

More than 60 in a minute from your IP address. Shown as a page

500

-

Something failed on Chartnaut's side. Shown as a page

PreviousRegister a clientNextGet a token