Sent to POST /api/oauth/codes by the /authorize page once the user
consents, from the query the client instance sent them with.
clientId: string
redirectUri: string
state: string
codeChallenge: string
codeChallengeMethod: string
nonce: string