Authorization Code flow with PKCE against an OpenID Provider (Entra ID or Okta) — every step is explicit in the Flask app (no auth SDK).
After login you’ll see the decoded ID token claims, then a protected profile.