ServicesAuth APIMicrosoft SSOCognito Hosted UI redirect URICognito Hosted UI redirect URI GET /callback Receives the Hosted UI authorization code + signed state, then 302-redirects to the SPA with the code and a tenant state blob attached. Request Responses302401Redirect to the SPA.Invalid state or unknown tenant.