Provider-facing
Sign in to a provider without a consent page
POST
Posted by the sign-in form. The password is sent to the provider only, never logged, and
kept sealed under OHS_ENCRYPTION_KEY with the connection, so the server can sign in
again when the provider's token expires. A refused password renders the form again
(401) and keeps the state; success ends like the OAuth callback.
provider*stringConnector slug, see GET /v1/providers.
application/x-www-form-urlencoded- body
state*stringemail*stringpassword*stringFormat
passwordBuilt-in result page, when the connect call gave no redirect_uri.
response?stringtext/htmlcurl -X POST 'http://localhost:8080/oauth/withings/signin' \ -H 'Content-Type: application/x-www-form-urlencoded' \ -d 'state=string&email=string&password=pa%24%24word'"string"