No GET calls to trigger auth with 3rd parties

Clients will have to do that part themsevles, displaying in-app browsers or forwarding the user's web browser as appropriate, then POST the details to the SW API.