Hello,

I'm trying to integrate Box OAuth2 into my Android application. With Box SDK I wrote

BoxAPIConnection.getAuthorizationURL(

            clientId,

            URI.create("oauth://box.oauth2/redirect"),

            state,

            scopes,

        )

I got

https://account.box.com/api/oauth2/authorize?client_id=<REDACTED>&response_type=code&redirect_uri=oauth%3A%2F%2Fbox.oauth2%2Fredirect&state=<REDACTED>&scope=root_readonly

which looks pretty decent. However when I login with my Box.com account which links to my Google account which has 2FA enabled, when authentication at Box succeeded and it should go back to my Android app, which would handle the "oauth://box.oauth2/redirect" above, it instead gives this page

Box Java SDK 4.6.1, with Pixel 5 emulator running Android 11 and stock Google Chrome.

Tried to reveal the URL to Chrome I got instead

https://account.box.com/login/mfa?redirectUrl=%2Fapi%2Foauth2%2Fauthorize%3Fscope%3Droot_readonly%26response_type%3Dcode%26redirect_uri%3Doauth%253A%252F%252Fbox.oauth2%252Fredirect%26client_id%3D<REDACTED>%26state%3D<REDACTED>

Which my Android app wasn't able to capture the deeplink and take back control. Is there anything I missed?

Original discussion:

https://forum.box.com/t/weird-oauth2-callback-url/1528