> For the complete documentation index, see [llms.txt](https://docs.loomai.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.loomai.com/api/authentication/implicit-flow.md).

# Implicit Flow

Use for

* Single-Page Web Applications

Following process describes how to obtain an user's authorization to interact with the Loom AI API on the user's behalf using the [OAuth2 Implicit Flow](https://oauth.net/2/grant-types/implicit/).

### 1. User Authentication & Request Authorization

Redirect the user to following parameterized URL to authenticate the user and request authorization for your application to interact with the Loom AI API on the user's behalf.

```http
https://auth.loomai.com/authorize?
  response_type=token&
  audience=https%3A%2F%2Fapi.loomai.com%2F&
  client_id={CLIENT_ID}&
  redirect_uri={REDIRECT_URI}&
  scope={SCOPE}&
  state={STATE}
```

| Parameter       | Description                                                                                                                                                                                                                                                    |
| --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `response_type` | Set to `token`.                                                                                                                                                                                                                                                |
| `audience`      | Set to `https://api.loomai.com/`(url-encoded).                                                                                                                                                                                                                 |
| `client_id`     | Your application's [Client ID](/guides/api-credentials.md).                                                                                                                                                                                                    |
| `redirect_uri`  | The URL to which the user will be redirected after authorization has been completed (url-encoded). The access token will be appended to the URL using an url fragment (`#`).                                                                                   |
| `scope`         | Whiite-space separated list of scopes you are requesting authorization for. Please refer to [Authorization Scopes](/api/schema/scope.md#authorization-scopes) for more details.                                                                                |
| `state`         | A random alphanumeric string your client application adds to the request. The value will be included when redirecting back to your application. This is used to prevent [CSRF attacks](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29). |

#### Request

```markup
<a href="https://auth.loomai.com/authorize?
    response_type=token&
    audience=https%3A%2F%2Fapi.loomai.com%2F&
    client_id={CLIENT_ID}&
    redirect_uri=https%3A%2F%2Fapp.domain.tld%2Foauth%2Fcallback&
    scope=read:avatars%20write:avatars&
    state=0xdeadbeef">
    Sign In
</a>
```

#### Response

If all parameters are valid, you will receive a HTTP 302 response redirecting to your specified `redirect_uri` with an url fragment, encoded as query parameters, that contains the authorization result. Specifically the `access_token` required to use the Loom AI API as well as additional information like token lifetime, authorized scopes etc.

If authorization failed or has been denied by the user, the url fragment will contain an error parameter with further details instead.

```http
HTTP/1.1 302 Found
Location: https://app.domain.tld/oauth/callback#
    access_token=ACCESS_TOKEN&
    expires_in=3600&
    token_type=Bearer&
    scope=AUTHORIZED_SCOPES&
    state=0xdeadbeef
```