Skip to main content

Redirect to an upstream identity provider

GET 
/oauth2/federation/start

Federation leg of the browser login: reads the esp_flow_id cookie set by /oauth2/authorize, mints an upstream-only state (HMAC-bound to the flow), nonce, and PKCE verifier, persists them on the flow record, and 302s the browser to the provider's hosted login (Cognito hosted UI in the open-source deployment). The upstream leg is private to the broker — it never mixes with the client's own PKCE/state. See spec federation.md.

Request​

Responses​

Redirect to the provider's hosted login page.

Response Headers
    Location