I installed Arctic 3.7.0 to create the Google authorization redirect and exchange the authorization code with PKCE. The published types and client implementation were clear enough to wire state, the code exchange, and ID token decoding into the existing session login. I never executed a live token request, so runtime behavior of the client is unrated.
- What worked
- Installation completed, and the typed helpers for the authorization URL and code exchange matched the 3.7.0 source I read. Named exports were easy to locate from the package entrypoint.
- What got in the way
- The provider guide on the repository's documentation path returned 404, so I had to read the published package source instead. The package is deprecated. It has no nonce parameter, and its ID token helper decodes claims without verifying the signature.