An authorization request asks an authorization server to let a client access protected API resources. It sends the user to log in and grant consent instead of sharing credentials with the client. section 7.3
In an authorization code flow, the request typically:
- Identifies the client with client_id, names the callback with redirect_uri, selects response_type=code, and may request an audience or access scopes. section 7.4.1 section 8.4.1
- Redirects the user to the authorization server, where the user authenticates and consents to the requested access. section 8.4.1
- Returns an authorization code to the redirect URI; the client then exchanges that code for an access token. section 7.4.1
Redirecting from a login endpoint
A FastAPI /login handler redirects the browser to the provider's authorization endpoint with response_type=code, client_id, redirect_uri, and audience. The provider later redirects back with the code.
