Understood on the privacy concerns. Good point.

Agreed that the Callback URL is definitely preferable, if the consuming application has a backend (Lambda or more substantial). Thanks!