Is the "session_verifier" required and where should we create it?

[thphuccoder]

(Note: we are using Flutter framework, not native)
We are following exactly the flow you provided in your README.
We are at step 3: posting the authentication code to our backend. We're looking at your example below:

https://github.com/singpass/iOS-Singpass-in-app-browser-login-demo/blob/ff32306441cfbb9bd646e7f931279a0c526240bd/sample/ViewController.swift#L262C8-L262C8

var reqBody: [String: String] = [
	"code": authCode,
	"session_id": session_id,
	"session_verifier": sessionVerifier,
	"redirect_uri": kRedirectURI
]

• authCode: we can pull from Singpass after user logged in
• session_id: issued by the backend from step 1
• session_verifier: in the code, we can see that it is generated locally on the app.

1. Is this parameter required?
2. Can the backend generate it and return in in step 1 along with session_id? Or it should be generated from mobile only?