Add a provider account by signing in with the company (the console only)

Server URLloading...

POST

/provider-accounts:oauth-start

Send

Authorization

Body

The console only. Starts "Sign in with ", the way to add a provider account with no domain by the company's own OAuth consent screen. It answers the address to open in a popup. When the person approves access there, the shared sign-in callback (GET /connect/oauth/callback) makes the account: every domain the sign-in reaches, continuous access, with the access token and the refresh token kept encrypted (a token near its end is refreshed before it is used). The popup posts {ok, purpose: "account", provider, account_id} to return_origin, or {ok: false, code, message} when the person declined or it failed (access_denied, oauth_failed, oauth_scope_not_granted, oauth_no_refresh, ProviderAuthenticationError, account_check_failed); a token the account did not keep is revoked at the company. Signing in again to the same account (DNSimple's account, a Vercel team) renews the account it made before instead of adding a second one.

The state binds the workspace, the member who started it and the application, is single use and lives ten minutes. Nothing is written before the callback.

Offered only where account_ways of GET /providers names oauth for the company: the deployment runs the company's OAuth app, keeps what it hands back (OAUTH_MANAGED_PROVIDERS and a grant encryption key), does not hold the sign-in back, and the company's sign-in needs no domain. Any other is 403 oauth_account_unavailable. The caller is the console's own call, as for POST /provider-accounts:sign-in: an API key that carries the console's signed visitor forward, held by a member who operates applications (403 browser_account_unavailable otherwise; a viewer is 403 forbidden). A workspace an operator suspended starts none (403 workspace_suspended).

Response Body

curl -X POST "https://example.com/provider-accounts:oauth-start" \  -H "Content-Type: application/json" \  -d '{    "provider": "string",    "return_origin": "string"  }'

{  "authorize_url": "http://example.com",  "provider": "string",  "flow": "oauth2",  "callback_origin": "string"}

{  "code": "string",  "title": "string",  "details": "string"}

{  "code": "string",  "title": "string",  "details": "string"}

{  "code": "string",  "title": "string",  "details": "string"}

{  "code": "string",  "title": "string",  "details": "string"}

{  "code": "string",  "title": "string",  "details": "string"}