Show the OAuth2 login page

Not part of the Sandbox

A Sandbox key does not authenticate this endpoint and a Sandbox identity cannot complete it, because it belongs to the separate OAuth2 authentication flow. It is published here because the Sandbox runs the same build. See Sandbox.

Render the SOXAI login page that starts the OAuth2 authorization code flow. A third-party client sends the user’s browser here.

The request is validated against the client registration before the page is shown: an unknown client_id, a redirect_uri that is not the registered one, or a scope wider than the client was granted are all refused rather than rendered.

Parameters

• client_id (query, required) - the registered OAuth2 client.
• redirect_uri (query, required) - must equal the URI registered for that client.
• scope (query, required) - must be a subset of the scope registered for that client.
• state / nonce (query, optional) - passed through to the redirect.

Redirect URIs and testing

• Production clients are registered with an https redirect URI only. A loopback URI such as http://localhost:8000/callback is not accepted in Production.
• To test the flow from a local machine, use the test client and the test environment that SOXAI provides. Loopback redirect URIs are accepted only there.

Response

• 200 returns the login page as HTML. After successful sign-in, the browser continues through the authorization flow.

Errors

Status	Condition
400	redirect_uri does not match the registration, or scope exceeds what the client may request
404	client_id is not registered

Authorization

• No authentication. This is part of the OAuth2 authorization flow, which runs before the caller has a SOXAI token.