Start

Build the WorkOS authorization URL and redirect.

• org_slug — when present, the start endpoint looks up the Organization's WorkOS organization id and routes through the tenant SSO connection. When absent, falls back to personal Google OAuth via WorkOS's built-in GoogleOAuth provider.
• frontend_origin — explicit browser origin. Required for browser logins and must match ALLOWED_FRONTEND_ORIGINS. Used to pick the callback host for dashboard-vs-cloud logins.
• next — post-login redirect target on the frontend. Validated to root-relative paths only.
• callback_port — when present, the success path will redirect to http://localhost:<port>/callback instead of setting a browser cookie. Used by qli login and the Electron app.