Skip to main content

Start browser login (authorization code + PKCE)

GET 
/oauth2/authorize

Begins the OAuth 2.1 / OIDC authorization-code flow. Validates the client, redirect_uri (exact match), and PKCE, writes an internal login flow record, sets an opaque flow_id session cookie, and routes the login surface by the enabled identity providers: with exactly one OIDC provider (the open-source Cognito case) the browser is 302d straight to /oauth2/federation/start; an OTP-only deployment deep-links to its login page; otherwise the built-in login page is served. After login the browser is redirected to the client's redirect_uri with a single-use code (and state). PKCE (S256) is required for every client. See specs authorize-code-flow.md and federation.md.

Request​

Responses​

Redirect to the login UI (with a flow_id session cookie). A post-validation error instead redirects to redirect_uri?error=<code>&state=<state>.

Response Headers
    Location
    Set-Cookie

    Short-lived HttpOnly Secure SameSite=Lax flow_id cookie.