Sign in
Auth

Oauth Login

Changed on

Redirect user to the IdP authorization URL with PKCE parameters.

The redirect_uri is handed to the IdP, where an attacker-controlled origin (via X-Forwarded-Host) would otherwise enable auth-code theft. We force explicit-config resolution by passing for_external_use=True; falling back to the request-origin is refused.

get/auth/oauth/{provider_slug}/login

Request

  • The document declares no server URL.
  • Auth: none declared

Path parameters

provider_slugstring required

Query parameters

noncestring required

A random 256-bit value, base64url without padding, that the page starting this sign-in keeps. The callback hands it back, and the page completes only a sign-in carrying its own value.

Changes