Starts the Authorization Code grant at the authorization endpoint. Redirect the User's browser to this endpoint. The User signs in, then approves or denies the request.

Proof then redirects to your redirect_uri per response_mode, carrying code and state on approval or error and error_description on denial. Every redirect also carries iss, the issuer identifier of this authorization server. Compare it to issuer from GET /.well-known/oauth-authorization-server and reject the response when they differ. Exchange the code at POST /oauth/v2/token within 10 minutes.

An unknown client_id or an unregistered redirect_uri sends the User to a Proof-hosted error page. Redirected errors use invalid_scope, invalid_target, access_denied and invalid_request.