Authorize a connection through provider sign-in
What It Does
Provider sign-in authorizes an account without collecting the person’s provider password. A signed short-lived state links the public return to the person and connection that began it. Token storage then follows ordinary credential arrival and verification.
The Flow
When Something Fails
Entered-key methods ask for replacement credentials; platform accounts need no sign-in. No authorization record is created on refusal. Reject setup that cannot be prepared. Abandoned state records wait for maintenance. A provider denial returns an error outcome to the console. Valid returned state is still consumed before the denial is handled. Invalid state produces a restart page; a failed exchange produces an error redirect or page. Claimed state cannot be reused, so the person must begin again. Retain the provider reason when verification fails. The saved tokens remain subject to normal credential lifecycle handling.
Open Design Questions
The credential milestone and complete provider sign-in acceptance remain proposed. Provider denial consumes valid callback state as well as exchange failure.