Authentication
POST /auth/extension/connect Browser extension only
Submit the consent decision and mint the extension’s session token.
Submitted by the consent screen’s own form, not called directly. On decision=allow, 302-redirects to redirect_uri with a session token in the URL fragment (never the query, so it is never logged or sent to a server); on anything else, redirects with error=access_denied. Not a JSON endpoint.
Body
redirect_uristring required- Must match the allowlisted redirect validated on the GET step.
statestring- Opaque value echoed back.
decisionstring requiredalloworcancel.Exampleallow
# submitted by the consent page's own form, not called directly