Create an admin account and connect your application to OIDCFlow.
You'll receive a client ID and a one-time client secret (save it; PKCE still applies at the token endpoint when using a public client).
Save these credentials securely. Client secret is shown only once and is never retrievable again.
Use this as client_id in your authorization requests.
Use at the token endpoint only when token_endpoint_auth_method is
client_secret_post. For none (PKCE), keep this secret off the wire and store it securely for your records.
Replace STATE, NONCE, and
CODE_CHALLENGE with values generated by your app before redirecting.