Parameter	Description
Client Id	Your third-party client Id
Redirect Uri	The page where Auth0 would respond with the User Code, which you will then use to call Auth0 to get Token\RefreshToken
Scope	The scope(s) which you want the user to consent to, separated with an empty space between each of the scopes listed below: read:clients, write:clients, read:leads, write:leads, read:catalogues, write:catalogues, offline_access,etc. E.G.: offline_access read:clients write:clients read:catalogues write:catalogues offline_access must be included to enable refreshing the accessToken by using the refresh token.
BxContext	The value in the query string on the initial redirect. If not present, some default value might be picked, and the API calls might not provide the desired outcomes.
Code Challenge	Required for strict-mode applications (Client Id starting with tpc_); recommended for all. Generate a random code_verifier (43-128 characters: letters, digits, "-", ".", "_", "~"), store it for Step 3 (e.g. in session storage), then send code_challenge = BASE64URL(SHA256(code_verifier)). Without it, strict-mode applications receive the error "The PKCE protocol extension is required".
Code Challenge Method	S256 (static)