Signup Start

Sign-up entry point.

?sms_consent=1 (Rob, 2026-10-22, A2P 10DLC): the unchecked-by-default SMS consent checkbox under the phone field. A phone number is accepted only with it; without it the explainer is shown again with an error.

?phone= (Rob, 2026-10-20): mobile number from the mode card. Required and validated for mode=approve (the callback then sends a 6-digit code and the creator confirms it before reaching the dashboard); optional for mode=auto. Normalized to E.164 and carried in the signed state cookie.

?mode=auto|approve (Rob, 2026-10-19) picks the optimization mode the creator chose on the explainer page; it selects the scope set sent to Google and is carried in the state cookie to the callback, which stores it as users.approval_mode. Missing or unknown -> "auto".

Two response modes, picked by query string:

1. NO ?confirmed (or ?confirmed != "1") -> return _signup_explainer_page, a self-contained HTML page that previews Google's account chooser + consent screen and lets the user click "Sign in with Google" to start the actual OAuth dance. The CTA on that page links to this same endpoint with ?confirmed=1.

2. ?confirmed=1 -> the original behavior: build the Google OAuth URL, set the state cookie, log signup_started/oauth_clicked funnel events, and 307 redirect to accounts.google.com.

The ?missing param is only honored on the explainer-page branch and is a comma-separated list of scope URLs the user failed to grant on a previous attempt; the page renders a warning banner with their plain- English labels.