Builds the authorization-endpoint URL and the PKCE/CSRF material for one
sign-in attempt (RFC 6749 §4.1.1 + RFC 7636 §4.3). The caller is
responsible for:
persisting state and codeVerifier somewhere that survives the
redirect round trip but is scoped to this attempt (sessionStorage
or an in-memory map keyed by state both work; they must not leak into
a different concurrent sign-in attempt, e.g. two tabs)
navigating the user (or a popup) to url
calling parseAuthorizationCallback with the redirect and the
persisted state when the user comes back.
Builds the authorization-endpoint URL and the PKCE/CSRF material for one sign-in attempt (RFC 6749 §4.1.1 + RFC 7636 §4.3). The caller is responsible for:
stateandcodeVerifiersomewhere that survives the redirect round trip but is scoped to this attempt (sessionStorageor an in-memory map keyed bystateboth work; they must not leak into a different concurrent sign-in attempt, e.g. two tabs)urlparseAuthorizationCallbackwith the redirect and the persistedstatewhen the user comes back.