Authorization endpoint (CIMD + PKCE)

GET 
/oauth2/authorize

Validates the client via its CIMD document, then redirects to the upstream Cognito authorization endpoint. Localhost redirect URIs match port-agnostically per RFC 8252 §7.3.

Request

Responses

302

Redirect to Cognito login

400

Invalid request (missing PKCE, CIMD validation failure, etc.)