diff --git a/src/oauth2.ts b/src/oauth2.ts
index f607cab..d99a15a 100644
--- a/src/oauth2.ts
+++ b/src/oauth2.ts
@@ -24,7 +24,7 @@ export default class OAuth2 {
     return (
       `https://${options.host}/OAuth2AccessRequest.action?` +
       Object.keys(params)
-        .map((key) => (params[key] ? `${key}=${params[key]}` : ""))
+        .map((key) => (params[key] ? `${key}=${encodeURIComponent(params[key])}` : ""))
         .filter((x) => x.length > 0)
         .join("&")
     );
diff --git a/test/test.ts b/test/test.ts
index 1427ff4..09e5c13 100644
--- a/test/test.ts
+++ b/test/test.ts
@@ -32,6 +32,16 @@ describe("OAuth2 API", () => {
     expect(oauth2.getAuthorizationURL({ host, redirectUri, state })).toBe(expected);
   });
 
+  it("should encode parameter values in the authorization url.", () => {
+    const redirectUri = "https://app.example.com/callback?tenant=acme&lang=ja";
+    const state = "ab+cd/ef==";
+    const params = new URL(oauth2.getAuthorizationURL({ host, redirectUri, state })).searchParams;
+
+    expect(params.get("redirect_uri")).toBe(redirectUri);
+    expect(params.get("state")).toBe(state);
+    expect([...params.keys()]).toEqual(["client_id", "response_type", "redirect_uri", "state"]);
+  });
+
   it("should get access token.", async () => {
     mockRequest({
       method: "POST",