HMAC-SHA256 a payload with secret, base64url-encoded. The canonical signer — the demo's OAuth state signing reuses it rather than re-rolling importKey + subtle.sign (two HMAC paths drift; the base64url pair already did).
secret
HMAC-SHA256 a payload with
secret, base64url-encoded. The canonical signer — the demo's OAuth state signing reuses it rather than re-rolling importKey + subtle.sign (two HMAC paths drift; the base64url pair already did).