The flow can be invoked from a user-facing process. Here are the parameters:

- `/services/auth/xds` - external data service handler will issue the logout redirect,
- `&startURL=/0XA...` - the Named Credential ID tells SF what to link the grant against,
- `&scope=full` - list of scopes or privileges presented to the user in the Grant Access screen,

Apex code to return such a URL from a VF page action or button:

    public PageReference authorizeNamedCredential(String authProvider, String namedCredential)
    {
        AuthProvider provider = [
            SELECT Id
            FROM AuthProvider
            WHERE DeveloperName = :authProvider
        ];
        
        NamedCredential credential = [
            SELECT Id
            FROM NamedCredential
            WHERE DeveloperName = :namedCredential
        ];
        
        String oid = UserInfo.getOrganizationId();
        String domain = Url.getOrgDomainUrl().toExternalForm();
        String path = '/services/auth/xds/' + oid + '/' + authProvider;
        String startUrl = '/' + String.valueOf(credential.Id).left(15);
        
        PageReference redirect = new PageReference(domain + path);
        redirect.getParameters().put('startURL', startUrl);
        redirect.getParameters().put('scope', 'full refresh_token');
        return redirect;
    }