Login

Redirect to WorkOS AuthKit sign-in. Call with GET from frontend (e.g. window.location).

Optional shop_id pre-selects that shop's WorkOS organization so AuthKit skips the org chooser — the in-app shop switcher re-runs login with it to re-mint the session for another shop without re-entering credentials. Membership is enforced by WorkOS itself (it will not mint a session for an org the user does not belong to), so an arbitrary shop_id cannot grant access it shouldn't. The DB dependency is optional on purpose: a plain login must keep working when the database is down (we just fall back to the org chooser).

Optional return_to (validated relative path) rides the OAuth state param so the callback can land the user back where they were — the shop switcher passes the current path. Shop-scoped entity pages may 404 in the new shop; the page's own not-found handling covers that.

Optional screen_hint ("sign-up"/"sign-in") and login_hint (an email) are for the landing page's self-serve signup entry point: open AuthKit on its registration screen with the address already filled in. Both are ignored unless they look right, and neither grants anything — AuthKit still verifies the address before a session exists.