Authorization endpoint (OAuth 2.1, PKCE required)

Validates the request server-side and redirects the user to the consent screen. PKCE with S256 is mandatory: a request without code_challenge, or with code_challenge_method other than S256, is refused.

redirect_uri is matched exactly against the client's registration — from the Client ID Metadata Document for a URL client_id, or from the dynamic registration otherwise. It is never taken from the parameter alone.

Errors are redirected to the client only once the redirect has been validated; before that they render an error page, because redirecting an error to an unvalidated URI is an open redirect.