> ## Documentation Index > Fetch the complete documentation index at: https://docs.rafflesia.ai/llms.txt > Use this file to discover all available pages before exploring further. # Start a CLI sign-in and return the AuthKit authorization URL. > Begins the PKCE sign-in flow for a command-line client. Supply the loopback redirect_uri your CLI is listening on, an opaque state value, and the S256 code_challenge whose verifier you keep locally; the response returns the hosted authorization URL to open in a browser, echoing back the redirect_uri and state to compare on the callback. Only loopback redirect URIs are accepted, so an authorization code can never be delivered off the machine that asked for it. ## OpenAPI ````yaml /api-reference/openapi.json get /v1/auth/cli/authorize openapi: 3.1.0 info: description: >- Deterministic biological evidence primitives. Every response is the same envelope: ok, data, warnings, provenance. title: Rafflesia API version: 0.1.0 servers: - description: Production url: https://api.rafflesia.ai security: - bearerAuth: [] paths: /v1/auth/cli/authorize: get: tags: - Auth summary: Start a CLI sign-in and return the AuthKit authorization URL. description: >- Begins the PKCE sign-in flow for a command-line client. Supply the loopback redirect_uri your CLI is listening on, an opaque state value, and the S256 code_challenge whose verifier you keep locally; the response returns the hosted authorization URL to open in a browser, echoing back the redirect_uri and state to compare on the callback. Only loopback redirect URIs are accepted, so an authorization code can never be delivered off the machine that asked for it. operationId: auth.cli.authorize parameters: - description: Loopback URL the CLI listens on. explode: false in: query name: redirect_uri schema: description: Loopback URL the CLI listens on. type: string - description: Opaque value echoed back to the CLI. explode: false in: query name: state schema: description: Opaque value echoed back to the CLI. type: string - description: PKCE code challenge. explode: false in: query name: code_challenge schema: description: PKCE code challenge. type: string - description: PKCE challenge method. Defaults to S256. explode: false in: query name: code_challenge_method schema: description: PKCE challenge method. Defaults to S256. type: string - description: AuthKit provider. Defaults to authkit. explode: false in: query name: provider schema: description: AuthKit provider. Defaults to authkit. type: string - description: Restrict sign-in to one WorkOS connection. explode: false in: query name: connection_id schema: description: Restrict sign-in to one WorkOS connection. type: string - description: Restrict sign-in to one organization. explode: false in: query name: organization_id schema: description: Restrict sign-in to one organization. type: string - description: Email to prefill. Ignored when it is not a valid address. explode: false in: query name: login_hint schema: description: Email to prefill. Ignored when it is not a valid address. type: string - description: Domain to prefill. explode: false in: query name: domain_hint schema: description: Domain to prefill. type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/AuthEnvelopeCLIAuthorizeData' description: OK headers: Set-Cookie: schema: type: string default: content: application/problem+json: schema: $ref: '#/components/schemas/ErrorModel' description: Error components: schemas: AuthEnvelopeCLIAuthorizeData: additionalProperties: false properties: $schema: description: A URL to the JSON Schema for this object. examples: - https://example.com/schemas/AuthEnvelopeCLIAuthorizeData.json format: uri readOnly: true type: string data: $ref: '#/components/schemas/CLIAuthorizeData' description: Operation result data. error: $ref: '#/components/schemas/AuthError' description: Structured error information. ok: description: Whether the operation succeeded. type: boolean required: - ok type: object ErrorModel: additionalProperties: false properties: $schema: description: A URL to the JSON Schema for this object. examples: - https://example.com/schemas/ErrorModel.json format: uri readOnly: true type: string detail: description: >- A human-readable explanation specific to this occurrence of the problem. examples: - Property foo is required but is missing. type: string errors: description: Optional list of individual error details items: $ref: '#/components/schemas/ErrorDetail' type: - array - 'null' instance: description: >- A URI reference that identifies the specific occurrence of the problem. examples: - https://example.com/error-log/abc123 format: uri type: string status: description: HTTP status code examples: - 400 format: int64 type: integer title: description: >- A short, human-readable summary of the problem type. This value should not change between occurrences of the error. examples: - Bad Request type: string type: default: about:blank description: A URI reference to human-readable documentation for the error. examples: - https://example.com/errors/example format: uri type: string type: object CLIAuthorizeData: additionalProperties: false properties: authorization_url: type: string redirect_uri: type: string state: type: string required: - authorization_url - redirect_uri - state type: object AuthError: additionalProperties: false properties: code: type: string details: {} message: type: string required: - code - message type: object ErrorDetail: additionalProperties: false properties: location: description: >- Where the error occurred, e.g. 'body.items[3].tags' or 'path.thing-id' type: string message: description: Error message text type: string value: description: The value at the given location type: object securitySchemes: bearerAuth: description: 'A Rafflesia API key, sent as `Authorization: Bearer `.' scheme: bearer type: http ````