Explainer is vague on how tokenURL works

[cbiesinger]

The explainer talks about a tokenURL that can be provided to fetch a token from the IdP after an account is selected.

But the explainer is vague on exactly how the fetch should be done and what data is provided. Perhaps (?) it should happen in the same way as FedCM Full does it, although there is no mention of an accountId in the proposal, making this harder.

Basically, it would be nice to know if the fetch will happen with GET or POST and with which parameters, if any.

[ekovac]

Agreed, this needs to be made more explicit. I believe we came to an agreement that, yes, this will use the same behavior as the assertion endpoint from FedCM. #42 (comment)

[cbiesinger]

That makes sense. I guess someone needs to figure out how to deal with the account_id the assertion endpoint sends right now.