MyUplink OAuth authorize returns invalid_request

[frahlg]

Bug Description

A Discord tester on v0.123.x reaches MyUplink's authorize page but MyUplink immediately renders:

Error
Sorry, there was an error: invalid_request
Request Id: 0HNM2R2L75RD7:000002B1

This happens before the redirect back to 42W, so it is likely an authorize URL parameter issue rather than the callback/token exchange path.

Evidence / suspicion

• Screenshot from Discord reporter Göran Andersson in #support, 2026-06-20.
• Current authorize URL builder sends scope as READSYSTEM offline_access.
• Earlier investigation noted MyUplink/Azure B2C may expect API scopes in fully-qualified form rather than bare READSYSTEM, and the portal does not expose manual scope selection.

Expected Behavior

Clicking Connect to MyUplink should show a MyUplink login/consent page and return an authorization code.

Actual Behavior

MyUplink displays invalid_request at api.myuplink.com immediately.

Environment

• Component: MyUplink OAuth setup / go/internal/api/api_myuplink_oauth.go
• Reporter: Discord Göran Andersson
• Related: MyUplink driver uses unsupported client_credentials OAuth flow #496 / MyUplink: authorization-code OAuth + in-app consent + heat-pump dashboard #497

Next steps

Capture the exact generated authorize URL minus secrets (client_id can be redacted) and test whether MyUplink requires fully-qualified scopes, different scope set, or rejects PKCE/redirect_uri for this app type.

[frahlg]

Triage (2026-07-18)

Scopes in core already match Home Assistant (WRITESYSTEM READSYSTEM offline_access). HA community reports of the same invalid_request on the authorize page almost always come from a callback URL that does not match the portal registration byte-for-byte.

Docs updated in the modbus PR to make that the primary troubleshooting step: copy the callback shown in Settings exactly (scheme/host/port/path, no trailing slash), open FTW from that same origin before Connect.

Not a code defect unless proven

• Default scope already includes WRITESYSTEM (required by MyUplink for some app types even though the driver is read-only)
• PKCE S256 is sent (harmless if ignored; required if Azure B2C enforces it)
• Manual paste path exists when the browser cannot reach the Pi callback

Leaving open for a field report with: redacted authorize URL, portal callback string, and whether HTTPS proxy is in the path. If no reproduce after doc guidance, close as configuration.