OAuth2 authorization endpoint (RFC 6749)
Validates the authorization request and 302-redirects into the Flowyte consent screen. An unknown client_id or a redirect_uri that is not an EXACT registered match renders an error page and NEVER redirects (anti-open-redirect); any other error redirects back to the validated redirect_uri with error=…&state=…. state is required; PKCE is optional (S256 only).
Authorizations
Flowyte secret API key (Authorization: Bearer flowyte_sk_live_…). Scope-gated; is scoped to your organization — a key can never reach another tenant. The listed scopes in each operation's apiKey requirement are the scopes that key must hold. The tokenUrl is nominal: keys are minted in the dashboard.
Query Parameters
Must be code (authorization-code grant is the only supported flow).
code The registered OAuth client id requesting access.
Where to send the browser after consent — must EXACTLY match a URI registered for the client.
Space-separated scopes requested; defaults to the client max when omitted.
Opaque CSRF value the client generates and expects echoed back on the redirect.
Optional PKCE code challenge (base64url of the SHA-256 of the verifier).
PKCE method — S256 only.
S256 Response
Redirect to the consent screen (success) or back to redirect_uri with an error.