Fully-formed issuer authorization URL to navigate to.
PKCE verifier; its S256 challenge went to the issuer, the verifier stays local.
Replay-defense nonce bound into and verified on the id_token.
Opaque CSRF value echoed back and checked against the callback.
PKCE authorization state that must survive the redirect round-trip. The caller persists it before navigating to the issuer and reloads it when the callback returns. It is single-use: delete it from storage before the code exchange so a replayed callback can never reuse the
codeVerifier(docs/24-sdk-design.md D3).Remarks
Most integrations should use createUpbond instead.