<!doctype html>
<html lang="en"><head><meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>OAuth demo</title>
<style>
  :root { color-scheme: light dark; --rule: #d5dbd9; --soft: #5c6b67; --accent: #0e6b63; }
  @media (prefers-color-scheme: dark) { :root { --rule: #2a3634; --soft: #9aaba7; --accent: #58c3b6; } }
  body { font: 16px/1.6 ui-sans-serif, system-ui, sans-serif; margin: 0; padding: 3rem 1.5rem; }
  main { max-width: 46rem; margin: 0 auto; display: flex; flex-direction: column; gap: 1.5rem; }
  h1 { font-size: 1.6rem; margin: 0; letter-spacing: -0.01em; }
  h2 { font-size: 1rem; margin: 1rem 0 0; text-transform: uppercase; letter-spacing: 0.08em; color: var(--soft); }
  p { margin: 0; color: var(--soft); }
  a.btn, button { font: inherit; display: inline-block; padding: 0.6rem 1.1rem; border-radius: 3px;
    border: 1px solid var(--accent); background: var(--accent); color: #fff; text-decoration: none; cursor: pointer; }
  a.ghost { background: none; color: var(--accent); }
  table { border-collapse: collapse; width: 100%; font-size: 0.9rem; }
  td, th { text-align: left; padding: 0.45rem 0.7rem; border-bottom: 1px solid var(--rule); vertical-align: top;
    word-break: break-word; }
  th { width: 12rem; font-family: ui-monospace, monospace; font-weight: 500; color: var(--soft); }
  pre { background: rgba(128,128,128,0.1); padding: 1rem; border-radius: 3px; overflow-x: auto; font-size: 0.82rem; }
  .row { display: flex; gap: 0.75rem; flex-wrap: wrap; align-items: center; }
  .tag { font-family: ui-monospace, monospace; font-size: 0.75rem; letter-spacing: 0.06em;
    text-transform: uppercase; color: var(--soft); border: 1px solid var(--rule); padding: 0.2rem 0.5rem; border-radius: 2px; }
</style></head><body><main><h1>Shared pool OAuth demo</h1>
     <div class="row"><span class="tag">stage dev</span><span class="tag">cognito-idp.us-west-2.amazonaws.com</span></div>
     <p>Signing in runs the authorization-code flow with PKCE against the shared Cognito pool at
        <code>https://auth.customer-dev.tenfoldai.io</code>, then calls a protected route to confirm API Gateway's
        JWT authorizer accepts the access token.</p>
     <div class="row"><a class="btn" href="/login">Sign in</a>
       <a class="ghost btn" href="/me">Call /me without a token</a></div>
     <p>The second link should return <code>401</code> — that is the authorizer rejecting an unauthenticated request.</p></main></body></html>