Oauth Login
const url = 'https://example.com/auth/oauth/example/login?nonce=example';const options = {method: 'GET'};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request GET \ --url 'https://example.com/auth/oauth/example/login?nonce=example'Redirect user to the IdP authorization URL with PKCE parameters.
The redirect_uri is handed to the IdP, where an
attacker-controlled origin (via X-Forwarded-Host) would otherwise
enable auth-code theft. We force explicit-config resolution by
passing for_external_use=True; falling back to the request-origin
is refused.
Parameters
Section titled “ Parameters ”Path Parameters
Section titled “ Path Parameters ”Query Parameters
Section titled “ Query Parameters ”A random 256-bit value, base64url without padding, that the page starting this sign-in keeps. The callback hands it back, and the page completes only a sign-in carrying its own value.
A random 256-bit value, base64url without padding, that the page starting this sign-in keeps. The callback hands it back, and the page completes only a sign-in carrying its own value.
Responses
Section titled “ Responses ”Successful Response
Bad request — invalid query parameters or payload
Unauthorized — missing or invalid credentials
Forbidden — caller lacks access to this resource
Not found
Validation error
Too many requests — retry after the advertised interval
Headers
Section titled “ Headers ”Seconds until the request may be retried
Internal server error
Service unavailable — the database could not serve the request