<?php
/**
 * Step 1 — start the OAuth flow.
 * Generate a random CSRF state, remember it in a short-lived cookie, and send
 * the user to BentBox's consent screen.
 */
require __DIR__ . '/config.php';

$state = bin2hex(random_bytes(16));
setcookie(BB_STATE_COOKIE, $state, bb_cookie_opts(time() + 600)); // 10 min

header('Location: ' . bb_authorize_url($state));
exit;