The API doesn’t need to include the site. The identity site just needs to verify age and return token that can be passed to site. Lots of identity protocols li

The API doesn’t need to include the site. The identity site just needs to verify age and return token that can be passed to site. Lots of identity protocols like OAuth have the provider do the redirect so they know the site. Which makes sense cause they want to validate the site. But it works to have the app do the redirect. They end up passing the token to the sire.