aaronpkso my recommendation would be to do the same, where this is not part of indieauth core, but we define an extension to say "if you want to decouple your auth and token endpoints, then here's a pattern you can use to have them talk to each other"
