Prompt

Space-delimited, case-sensitive list of values that specifies whether the Authorization Server prompts the End-User for reauthentication and consent.

• none — no UI is shown. Returns login_required without an active session, or consent_required when the scopes are not yet approved.
• create — the End-User must authenticate starting from the signup page, even with an active session, and can still switch to signing in with an existing account. Defined by Prompt Create.
• login — the End-User must reauthenticate, even with an active session.
• consent — the End-User must approve the requested scopes again, even if approved previously; declining returns access_denied.

login consent is the only supported combination; any other combination of known values is rejected with invalid_request.

Unrecognised values are ignored, so clients must not rely on a prompt being honoured.

If omitted, or without a recognised value, the End-User is prompted only when needed.