# request an idtoken + token
domain=api.any.com
clientId=54231
redirectUri=http://localhost:4200/callback # callbackurl
responseType=id_token token  # or authcode
scope=openid profile Custom-API
nonce=one-time-id-token-id # attribute set on idtoken
state=/abc # any state, returned in callback url
https://{domain}/connect/authorize?client_id={clientId}&redirect_uri={redirectUri}&response_type={responseType}&scope={scope}&nonce={nonce}&state={state}

# to get just an access_token
responseType=token
scope=Custom-API
https://{domain}/connect/authorize?client_id={clientId}&redirect_uri={redirectUri}&response_type={responseType}&scope={scope}

Source: https://stackoverflow.com/a/42406778

function genNonce() {
    const charset = '0123456789ABCDEFGHIJKLMNOPQRSTUVXYZabcdefghijklmnopqrstuvwxyz-._~'
    const result = [];
    window.crypto.getRandomValues(new Uint8Array(32)).forEach(c =>
        result.push(charset[c % charset.length]));
    return result.join('');
}

console.info(genNonce());