Popup mode
Uses window.opener.postMessage(...) and closes the popup after success.
AuthNova
This page collects a Google id_token and safely returns it to the calling product.
Uses window.opener.postMessage(...) and closes the popup after success.
Redirects back to the caller using URL hash, never query string, to avoid token leakage.