Generates a browser authorization URL for connecting a new social account to a project.
This endpoint is useful for multi-user integrations where your application lets
your own users, clients, or brands connect their social accounts to WoopSocial
without giving them access to your WoopSocial account.
A common flow is:
1. Create or select a WoopSocial project for your user, client, or brand.
2. Call this endpoint from your backend with that `projectId`, the target `platform`,
and a `redirectUrl` in your application.
3. Open the returned `url` in your user's browser.
4. After OAuth completes, WoopSocial redirects the browser back to `redirectUrl`
with result query parameters.
5. Use `projectId` and `socialAccountIds` from the redirect, or call
`GET /social-accounts?projectId=...`, to store or confirm the connected account
in your application.
When `redirectUrl` is provided, the browser is redirected back to that URL after
the OAuth callback is handled.
For Facebook, WoopSocial shows a page-selection screen after authorization
because Facebook may return more pages than the user appeared to select in
the Facebook dialog in cases where the user has authorized with WoopSocial previously. The selected pages are connected to the single
`projectId` from this request, then WoopSocial redirects back to
`redirectUrl` when one was provided.
When `redirectUrl` is provided, WoopSocial appends these query parameters on success:
- `status=success`
- `projectId`: the project identifier from the request
- `platform`: the connected social platform
- `socialAccountIds`: comma-separated connected social account identifiers. This may contain one or more IDs depending on the platform OAuth flow.
When `redirectUrl` is provided, WoopSocial appends these query parameters on failure:
- `status=error`
- `projectId`: the project identifier from the request
- `platform`: the requested social platform
- `error`: an OAuth callback error code
If the OAuth callback state is missing or expired, WoopSocial cannot safely
determine the original `redirectUrl`, so the callback returns an HTTP error
instead of redirecting.
The redirect never includes OAuth tokens or credentials.