GET /api/v1/auth/oidc/launch

OpenID Connect sign-in, step 2: the sign-in window; sets the login transaction cookie and redirects to the provider.

Opened by the sign-in window from step 1's launchUrl. Consumes the launch token ONCE, sets the login transaction cookie and answers 302 to the provider's authorization endpoint (PKCE S256, state, nonce, the binding's callback URI).

The cookie is the one cookie this surface ever sets: te_oidc_<first 8 characters of flowId>, HttpOnly; Secure; SameSite=Lax; Path=/api/v1/auth/oidc, Max-Age the transaction's remaining life. It has no API authority: a request carrying it and nothing else is unauthenticated on every route. It is cleared by the callback.

Authentication

No session required. This operation is reachable without an Authorization header. See Authenticating.

Parameters

Name	In	Required	Type	Description
flow	query	yes	string
t	query	yes	string	The single-use launch token.

Request

No request body.

Responses

302

To the provider's authorization endpoint.

401

TRANSACTION_UNKNOWN -- no pending sign-in has that flow and launch token. Start again.

403

BINDING_NOT_AVAILABLE -- the provider is no longer configured.

410

LAUNCH_CONSUMED -- this sign-in window was already opened once. Start again.

503

IDP_UNAVAILABLE (Retry-After) -- the provider's discovery could not be used. OIDC_NOT_CONFIGURED (Retry-After).

Error handling

Every failure answers JSON carrying at least code and detail. Match on code — detail is written for a human debugging the call and its wording is not part of the contract. See the error model.

Status	Meaning
401	TRANSACTION_UNKNOWN -- no pending sign-in has that flow and launch token. Start again.
403	BINDING_NOT_AVAILABLE -- the provider is no longer configured.
410	LAUNCH_CONSUMED -- this sign-in window was already opened once. Start again.
503	IDP_UNAVAILABLE (Retry-After) -- the provider's discovery could not be used. OIDC_NOT_CONFIGURED (Retry-After).