OAuth code flow with PKCE

Drag a card, use the arrows, or tap two cards to swap them.

1. 1
   Check that the returned state matches the pending client request
2. 2
   Send the code, verifier, client ID, and matching redirect URI to the token endpoint
3. 3
   Validate all code bindings and the S256 verifier; consume the code
4. 4
   Issue tokens; use the access token only for its allowed resource and scope
5. 5
   Create fresh state and verifier; derive the S256 challenge
6. 6
   Send the browser authorization request with state, challenge, and registered redirect URI
7. 7
   Authenticate the user, obtain consent, and redirect with a bound one-use code and state