You're correct the callurl.trim() is the verify code that the user put in (the reason it's trimmed is if they copy and pasted the code. After they visited the original URL and got the code after allowing the app. Which is sent over the network.
↧