🔒 OAuth Required

Mints a Plex web-auth URL for the client to open. Plex uses a 2-step PIN OAuth; the PIN is stashed server-side under an opaque state token and Plex is forwarded to a website return endpoint that exchanges it and redirects back to your return_url with ?plex_status=connected|error.

return_url is validated against the trakt-owned allowlist (trakt://, http(s)://localhost, https://*.trakt.tv); a 400 is returned otherwise.