Generate a cryptographically random code_verifier and derive the code_challenge. These values will be used throughout the flow.

POST the authorization parameters directly to the PAR endpoint. The server returns a request_uri that you use in place of all parameters in the redirect.

Redirect the user-agent to the authorization endpoint. The URL contains only client_id and the request_uri from PAR (or full params if PAR was skipped).

Exchange the authorization code for tokens. The code_verifier is sent to prove possession of the PKCE secret.

Fetch user claims from the UserInfo endpoint using the access token as a Bearer credential.

Use the refresh token to obtain a new access token without user interaction.

Redirect to the end_session_endpoint with the id_token_hint and optional post_logout_redirect_uri.