This page uses the implicit flow, which is deprecated: the access token is returned in the redirect URL and can leak or be replayed. The recommended alternative is the authorization code flow with PKCE. The login of this sample uses the authorization code flow, PKCE can be enabled per client. See RFC 9700, section 2.1.2 for details.