Authorize Consent

Human-facing consent screen. The external app sends the user here (this is the authorize_url the connecting app redirects to); on Allow the page calls POST /oauth2/authorize and forwards the browser to the returned redirect_url.

If the user isn't signed in, the page runs an interactive Auth0 login whose callback returns to THIS url with ?code=... (the original OAuth params are carried client-side in Auth0 appState). In that callback case we render the shell and let the JS restore the params — so client_id/redirect_uri are optional.