Clicking the button sends you to the API, which sets a CSRF state cookie and redirects you to MemberClicks. After you authenticate, MC redirects back here with ?code=&state=. The callback handler below exchanges those for a JWT.