Chris Saunders commented on Embedded App SDK Redirects

The redirect needs to happen as part of the OAuth flow as per the docs here. In particular this bit:

Since the application is loaded inside an iframe it is critical that the initial OAuth request redirect escapes the iframe to make the requests.