OpenVPN Authentication Script
The URL encoding looks correct. However, that doesn't mean that users cannot enter something malicious that will trigger some bug in the server. But that's up to the server implementation to be robust to malicious inputs. Also note that anybody with access to this script can read your API key and make arbitrary API calls.

Many lines end with ;. This is pointless, you should remove all those ;.

The exit code of a Bash script is the exit code of the last command.
So you could replace the last if-else condition with this simple line, and get the exact same effect:

[ "$responseCode" -eq "202" ]