2020-11-17 UTC
# 
[Simon_Willison] `https://example.org/auth?response_type=code&client_id=https://app.example.com/&redirect_uri=https://app.example.com/redirect&state=1234567890&code_challenge=OfYAxt8zU2dAPDWQxTAUIteRzMsoj9QBdMIVEDOErUo&code_challenge_method=S256&scope=profile+create+update+delete&me=https://user.example.net/` URL but the only thing in there I could stash extra state in is the `state=` bit, and I’m supposed to be using that to confirm that it wasn’t