PKCE (RFC 7636) with the S256 method.
Opaque URL-safe random value, for state and nonce.
state
nonce
A 43–128 character verifier from 64 random bytes.