The pending authorisation, held between the redirect out and the callback back. The verifier never goes in a cookie or query parameter (that would make PKCE decorative).
The pending authorisation, held between the redirect out and the callback back. The verifier never goes in a cookie or query parameter (that would make PKCE decorative).