Answer the connector's consent page after a provider sign-in
A form post from the consent page the MCP intent's callback shows, not an API call. Needs the page's single-use consent token (10 minutes) and the browser-binding cookie of the browser that signed in. Authorize issues the authorization code to the client's registered redirect_uri; Cancel returns error=access_denied there. Both spend the token and clear the cookie. Limited to 30 attempts per address per 10 minutes.
POST
/auth/sso/consent This call takes no parameters.