Specifically for OAuth2 the authentication part for flows that requires redirect, is on the shoulders of the authentication platform. There is no specific API t

Specifically for OAuth2 the authentication part for flows that requires redirect, is on the shoulders of the authentication platform. There is no specific API that says how to do it. I can use my user/password to do the login. This is why you have to use a browser if that platform require you to enter the credentials in the browser. Up to that login and from that login, everything is governed by oauth2. An alternative system, might open the authentication phase in a mobile app or a biometric input, etc... The application at the end of the url will be deciding how to do that. The reason for the whole thing is that we want to separate the area in which needs protection (authorization) and the area which does the authentication and can sit at a trusted site and may supply services to several resource servers. You can play with such an implementation with an open source keycloak server. It really clearly reveals how the whole thing works.