Skip to main content

Start browser login (authorization code + PKCE)

GET 
/oauth2/authorize

Starts the authorization-code + PKCE (S256) login. Validates the client, the exact redirect_uri and PKCE, sets the __Host-esp_flow_id cookie, and sends the browser to the login: straight to /oauth2/federation/start when exactly one provider is enabled, to the OTP page in an OTP-only deployment, otherwise to /oauth2/login. On success the browser returns to redirect_uri with a single-use code and state.

A live __Host-esp_session cookie skips the login and returns the code immediately (single sign-on), unless prompt, max_age or id_token_hint rule it out.

Request​

Responses​

Redirect to the login UI (with a flow_id session cookie) — or, when a live session satisfies prompt/max_age/id_token_hint, straight back to redirect_uri?code=…&state=… with no login surface at all. A post-validation error instead redirects to redirect_uri?error=<code>&state=<state> (invalid_scope, invalid_target, or login_required for a failed prompt=none).

Response Headers
    Location
    Set-Cookie

    Short-lived HttpOnly Secure SameSite=Lax flow_id cookie.