Initiate OAuth 2.0 Flow — POST /v1/oauth/:provider

Use this endpoint to start an OAuth 2.0 authorization flow with either Discord or Roblox. You send a redirectUrl where you want the user to land after they authenticate, and the API returns the provider’s authorization URL along with a state token. You then redirect the user to that URL — the provider handles the rest.

Endpoint

POST /v1/oauth/:provider

Path Parameters

string

required

The OAuth provider to authenticate with. Must be one of:

discord
roblox

Request Body

string

required

The URL your application wants the user redirected to after the provider callback completes. This value must be a registered URL — the API rejects any URL that has not been approved for your application.

Response

A successful 200 response returns the following fields:

string

The full authorization URL on the provider’s side (e.g., https://discord.com/oauth2/authorize?...). Redirect the user to this URL to begin the consent flow.

string

A unique opaque token that ties this authorization request to the subsequent callback. The server stores this value server-side and validates it when the provider redirects back. You do not need to store or forward it manually — the provider appends it automatically during the callback.

Code Example

const res = await fetch('https://api.cacolombia.com/v1/oauth/discord', {
  method: 'POST',
  credentials: 'include',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ redirectUrl: 'https://yourapp.com/callback' })
});
const data = await res.json();
// { targetUrl: 'https://discord.com/oauth2/...', state: '...' }
window.location.href = data.targetUrl;

Example Response

{
  "targetUrl": "https://discord.com/oauth2/authorize?client_id=...&redirect_uri=...&state=1234567890abcdef&scope=identify",
  "state": "1234567890abcdef"
}

Errors

Status	Description
`400`	The `:provider` path parameter is not `discord` or `roblox`, or the request body is missing or malformed.
`403`	The `redirectUrl` you provided has not been registered for your application. Contact the CA Colombia team to register your domain.

You must be authenticated (i.e., your request must carry a valid session cookie) before calling this endpoint. Ensure your client passes credentials: 'include' so any existing session cookies are forwarded with the request.

Overview

Auth & OAuth

Users

Characters

Economy

Banking

Staff

Utilities

Initiate OAuth 2.0 Flow — POST /v1/oauth/:provider

Endpoint

Path Parameters

Request Body

Response

Code Example

Example Response

Errors

​Endpoint

​Path Parameters

​Request Body

​Response

​Code Example

​Example Response

​Errors

Endpoint

Path Parameters

Request Body

Response

Code Example

Example Response

Errors