OAuth 2.0 Authorization Endpoint

User must be logged in (authenticated with Supabase JWT). This endpoint creates an authorization code and returns a redirect URL.

PKCE (Proof Key for Code Exchange) is REQUIRED for all authorization requests.

The frontend consent screen should call this endpoint after the user approves, then redirect the user to the returned redirect_url.

Request Body:

• client_id: The OAuth application's client ID
• redirect_uri: Where to redirect after authorization (must match registered URI)
• scopes: List of permissions (e.g., "EXECUTE_GRAPH READ_GRAPH")
• state: Anti-CSRF token provided by client (will be returned in redirect)
• response_type: Must be "code" (for authorization code flow)
• code_challenge: PKCE code challenge (required)
• code_challenge_method: "S256" (recommended) or "plain"

Returns:

• redirect_url: The URL to redirect the user to (includes authorization code)

Error cases return a redirect_url with error parameters once the client and its redirect_uri check out; before that (unknown or inactive client, an unregistered redirect_uri) they raise HTTPException, so the platform never redirects to a URI no registered client vouches for (RFC 6749 4.1.2.1).