Having a bit of trouble understanding the point of the

login_challenge

. It states in the docs that "Ory Hydra appends a login_challenge query parameter to the url. The value is a ID which should later be used by the Login Endpoint to fetch important information about the request." What does this mean exactly? Does our implementation of the login endpoint need to call Ory Hydra with the challenge iD? I see the response, but its unclear why this step is needed as it doesn't match the inputs on the form for authenticating the user. Thanks.

You use the login challenge to call the Hydra admin endpoint which returns a response containing information such as the oauth client id etc

Thanks. What's the point of accepting or rejecting the request ?

That's upto you. You are verifying the oauth client with the login challenge

Hrmm ok sorta makes sense.

As an example, I store metadata regarding the oauth client (such as if it is allowed to do certain actions) and then allow/block the oauth client based on that metadata.

What's the flow? So ORY Hydra calls your backend, then you decide to show a login or not for a user to login for a particular oauth client..Whats an example logic of you rejecting and not allowing login?

I check the metadata and then accept/reject based on the permissions I set in the metadata. This is just my usecase

oh ok

Yes