User consent

Start user authorization

Follow the authorization code flow and redirect the browser to accounts /oauth2/authorize. Use the actual consent page behavior; do not depend on a fixed screenshot, per-scope checkboxes or a preview button.

Handle the callback in this order:

1. Verify state against the current sign-in request.
2. Check error. If the user declines, stop and explain the outcome without an automatic redirect loop.
3. Exchange code using the saved code_verifier.
4. Enable features using the scopes actually granted, not the requested parameters.

Application display information and OAuth client_id are separate concepts. See application creation.