There are two important steps:
- Server to server POST for initial OAuth key exchange to the Callback URL.
- User is redirected with a GET to the Identity Link URL.
How in the world are #1 and #2 connected?
I don't see any common data and the example from Magento just uses a common session, which I can only assume is a horrible idea. Even more confusing is why
consumer_id is sent with the user.