OAuth 2.1 authorization endpoint. Validates the request parameters, creates a
browser-bound PendingFlow record (15-minute TTL), and redirects the user to
the Bifrost consent screen at /oauth/consent?flow_id=xxx.
PKCE is required — code_challenge and code_challenge_method=S256 must
be provided. Plain code challenges are not supported.
A __bifrost_flow_secret HttpOnly SameSite=Lax cookie is set on redirect to
bind the consent flow to the initiating browser session (CSRF protection).
Authentication is not required — this is part of the unauthenticated OAuth bootstrap flow.
Bearer token authentication. Use your provider API key or Bifrost authentication token.
Virtual keys (prefixed with sk-bf-) can also be passed here.
Must be code
code Client ID obtained from the registration endpoint
Must match a URI registered for this client
PKCE code challenge (Base64URL-encoded SHA-256 of the code verifier)
Must be S256
S256 Opaque value to maintain state between request and callback (CSRF protection)
Redirect to consent screen at /oauth/consent?flow_id=xxx