Authorize a service

Starts PKCE OAuth from a valid connect session. The hosted connect UI calls this endpoint; a SaaS API key is not accepted from the browser.