In-flight authorization request — created by authorize, consumed by exchangeCode.
Hosts persist this object briefly (typically in a server-side session, keyed by stateNonce) between the authorize redirect and the callback.
Lifetime is seconds-to-minutes; once exchangeCode succeeds it can be discarded.
Confidential client secrets are intentionally not stored here — only the usesClientSecret flag is persisted.
In-flight authorization request — created by
authorize, consumed byexchangeCode.Hosts persist this object briefly (typically in a server-side session, keyed by
stateNonce) between the authorize redirect and the callback. Lifetime is seconds-to-minutes; onceexchangeCodesucceeds it can be discarded. Confidential client secrets are intentionally not stored here — only theusesClientSecretflag is persisted.