#sgreger"An authorization endpoint must be able to both generate authorization codes as well as verify authorization codes." -> so this means, my little hack is not really a proper endpoint, because it does not allow verifying codes from other sites?