Step 1 — Authorize (browser redirect, documentation)

Required — the id of the OAuth client you registered.

Required — must match a redirect URI registered against the client, character for character.

Required — always code for the authorization-code flow.

Optional — space-separated scopes to request. Defaults to *.

Required — an unguessable random string. Store it in the user's session and compare it when the callback arrives, to prevent CSRF.