Federated Login

Browser authorization-code + PKCE login brokered to an upstream identity provider (Cognito hosted UI in the open-source deployment). Clients only ever receive ESP User tokens.

📄️Start browser login (authorization code + PKCE)

Begins the OAuth 2.1 / OIDC authorization-code flow. Validates the

📄️Redirect to an upstream identity provider

Federation leg of the browser login: reads the `esp_flow_id` cookie set

📄️Upstream provider callback

The provider redirects here after the user authenticates. The broker