Authorization endpoint
RFC 6749 §4.1 authorization endpoint. Validates the client, redirect URI (exact match), scope, and PKCE challenge (S256 required), parks the request, and redirects the browser to the in-session consent page. On approval the consent step redirects back to redirect_uri with code, state, and iss (RFC 9207). If the client_id/redirect_uri cannot be trusted, an HTML error page is shown instead of redirecting; otherwise errors are returned as a redirect carrying error, error_description, state, iss.
Query Parameters
code Required when the client has more than one registered URI; must exactly match a registered URI.
Space-delimited; subset of the client's registered scopes (defaults to all).
Opaque value echoed back on the redirect.
PKCE S256 challenge.
S256 RFC 8707 resource indicator; must equal the canonical resource URI when supplied.
Response
Redirect — to the consent page (unauthenticated browser), or back to redirect_uri with code+state+iss on success or error+error_description+state+iss on a recoverable error.