@schibsted/account-sdk-browser 6.0.0-alpha.13 → 6.0.0-alpha.15

package/dist/types/account.d.ts

@@ -1,5 +1,6 @@
 import { AccountBaseConfig, LogFunction } from './common';
-import { IdentityBeforeRedirectCallback, VarnishCookieOptions } from './identity';
+import { ConsentReader, IdentityBeforeRedirectCallback, VarnishCookieOptions } from './identity';
+import { StateGenerator } from './login';
 import { SessionResponse } from './session';
 /**
  * Configuration used to create an {@link Account} instance.
@@ -9,10 +10,22 @@ import { SessionResponse } from './session';
 export type AccountConfig = Omit<AccountBaseConfig, 'env'> & {
     /** Schibsted account environment. Defaults to PRE. */
     env?: AccountBaseConfig['env'];
-    /** Receives debug log information. If not set, no logging will be done. */
+    /**
+     * Receives debug logs and consent reader errors.
+     * Without it, consent reader errors are reported through console.warn.
+     */
     log?: LogFunction;
     /** Callback triggered before a session refresh redirect happens. */
     callbackBeforeRedirect?: IdentityBeforeRedirectCallback;
+    /** Reads consents forwarded in login URLs. Defaults to the Schibsted Sourcepoint integration. */
+    getConsents?: ConsentReader;
+    /**
+     * Generates the OAuth `state` value used by `login()`, `loginUrl()`, and the simplified login
+     * widget when no explicit `state` is passed.
+     */
+    generateState: StateGenerator;
+    /** Refresh consents of rendered login links when clicked. Defaults to true. */
+    refreshLoginLinks?: boolean;
     /** Product or feature ids used by `hasAccess()` when no ids are passed to the method. */
     defaultProductIds?: readonly string[];
     /** Optional Varnish cookie setup applied during Account initialization. */

package/dist/types/common.d.ts

@@ -1,10 +1,10 @@
 /**
  * Log callback used by the SDK for debug output.
- * Receives a pre-formatted log line.
+ * Receives a pre-formatted log line and, when reading consents fails, the error.
  *
  * @group Configuration
  */
-export type LogFunction = (message: string) => void;
+export type LogFunction = (message: string, error?: unknown) => void;
 /**
  * Supported Schibsted account environment keys.
  *

package/dist/types/identity.d.ts

@@ -1,4 +1,9 @@
 import { AccountBaseConfig, LogFunction } from './common';
+import { StateGenerator } from './login';
+/**
+ * Synchronously returns the current consents as query parameters; must not wait for the user's decision.
+ */
+export type ConsentReader = () => URLSearchParams | null;
 /**
  * Callback invoked before the SDK performs a full-page session refresh redirect.
  */
@@ -7,10 +12,17 @@ export type IdentityBeforeRedirectCallback = () => void | Promise<void>;
  * Options accepted by the {@link Identity} constructor.
  */
 export type IdentityOptions = AccountBaseConfig & {
-    /** Receives debug log information. If not set, no logging will be done. */
+    /**
+     * Receives debug logs and consent reader errors.
+     * Without it, consent reader errors are reported through console.warn.
+     */
     log?: LogFunction;
     /** Callback triggered before a session refresh redirect happens. */
     callbackBeforeRedirect?: IdentityBeforeRedirectCallback;
+    /** Reads consents forwarded in login URLs. Defaults to the Schibsted Sourcepoint integration. */
+    getConsents?: ConsentReader;
+    /** Generates the OAuth `state` value when login options do not provide one. */
+    generateState?: StateGenerator;
 };
 /**
  * Options for {@link Identity#enableVarnishCookie}.

package/dist/types/login.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Generates the OAuth `state` value for a login flow. Receives the window the SDK was configured
+ * with and must synchronously return a non-empty string.
+ *
+ * @group Login & Widget
+ */
+export type StateGenerator = (window: Window) => string;
 /**
  * Options accepted by {@link Account#login} and related login URL helpers.
  *
@@ -7,8 +14,9 @@ export type LoginOptions = {
     /**
      * An opaque value used by the client to maintain state between the request and callback.
      * It's also recommended to prevent CSRF {@link https://tools.ietf.org/html/rfc6749#section-10.12}
+     * Defaults to the value returned by the configured `generateState` function.
      */
-    state: string;
+    state?: string;
     /**
      * Authentication Context Class Reference values. If omitted, the default account flow is used.
      * Supported values include `password`, `otp`, `sms`, `otp-email`, `eid`, `eid-no`, `eid-se`,
@@ -76,8 +84,9 @@ export type SimplifiedLoginWidgetLoginOptions = Omit<LoginOptions, 'state'> & {
     /**
      * An opaque value used by the client to maintain state between the request and callback.
      * It's also recommended to prevent CSRF {@link https://tools.ietf.org/html/rfc6749#section-10.12}
+     * Defaults to the value returned by the configured `generateState` function.
      */
-    state: string | (() => string | Promise<string>);
+    state?: string | (() => string | Promise<string>);
 };
 /**
  * Minimal user information used by the simplified login widget flow.

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-declare const version = "6.0.0-alpha.13";
+declare const version = "6.0.0-alpha.15";
 export default version;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@schibsted/account-sdk-browser",
-  "version": "6.0.0-alpha.13",
+  "version": "6.0.0-alpha.15",
   "description": "Schibsted account SDK for browsers",
   "main": "dist/index.js",
   "type": "module",
@@ -35,6 +35,7 @@
   "license": "MIT",
   "devDependencies": {
     "@biomejs/biome": "2.4.15",
+    "@schibsted/consent-url-utils": "^2.0.1",
     "@vitest/coverage-v8": "^4.1.7",
     "jsdom": "^29.1.1",
     "rimraf": "^6.1.3",
@@ -48,5 +49,8 @@
   "repository": {
     "type": "git",
     "url": "git://schibsted.ghe.com/user-identity/account-sdk-browser.git"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org/"
   }
 }

package/src/account.ts

@@ -17,6 +17,7 @@ import type {
 } from './types/login.js';
 import type { HasAccessResult } from './types/monetization.js';
 import type { ConnectedSessionResponse, SessionResponse, SessionUserId } from './types/session.js';
+import { assert } from './validate.js';
 
 /**
  * Unified client-side interface for a configured Schibsted Account integration.
@@ -46,7 +47,15 @@ export class Account {
             throw new SDKError('Schibsted Account SDK has already been initialized');
         }
 
-        const { log, callbackBeforeRedirect, defaultProductIds, varnish } = config;
+        const {
+            log,
+            callbackBeforeRedirect,
+            getConsents,
+            generateState,
+            refreshLoginLinks = true,
+            defaultProductIds,
+            varnish,
+        } = config;
         const sharedConfig = {
             clientId: config.clientId,
             redirectUri: config.redirectUri,
@@ -55,10 +64,18 @@ export class Account {
             window: browserWindow,
         };
 
+        assert(typeof generateState === 'function', 'generateState parameter must be a function');
+        assert(
+            typeof refreshLoginLinks === 'boolean',
+            'refreshLoginLinks parameter must be a boolean',
+        );
+
         this.#identity = new Identity({
             ...sharedConfig,
             log,
             callbackBeforeRedirect,
+            getConsents,
+            generateState,
         });
 
         if (defaultProductIds !== undefined && !Array.isArray(defaultProductIds)) {
@@ -84,6 +101,9 @@ export class Account {
         if (sessionState) {
             sessionStates.set(this, sessionState);
         }
+        if (refreshLoginLinks) {
+            this.#identity.enableLoginLinkRefresh();
+        }
         browserWindow.schAccount = this;
         browserWindow.dispatchEvent(
             new CustomEvent('schAccount:ready', { detail: { instance: this } }),
@@ -219,10 +239,11 @@ export class Account {
      * Call this from a user gesture when `preferPopup` is enabled, otherwise browser popup blockers
      * may block the popup and the SDK will fall back to redirect navigation.
      *
-     * @param options - Login URL parameters.
+     * @param options - Login URL parameters. When `state` is omitted, the configured
+     * `generateState` function provides it.
      * @returns A popup window reference when a popup is opened; otherwise `null`.
      */
-    login(options: LoginOptions): Window | null {
+    login(options: LoginOptions = {}): Window | null {
         return this.#identity.login(options);
     }
 
@@ -238,9 +259,10 @@ export class Account {
     /**
      * Builds the login URL without navigating the browser.
      *
-     * @param options - Login URL parameters.
+     * @param options - Login URL parameters. When `state` is omitted, the configured
+     * `generateState` function provides it.
      */
-    loginUrl(options: LoginOptions): string {
+    loginUrl(options: LoginOptions = {}): string {
         return this.#identity.loginUrl(options);
     }
 
@@ -266,14 +288,15 @@ export class Account {
      * Loads and displays the simplified login widget when user context is available.
      *
      * Your application decides how often to call this method. The `state` field in `loginParams`
-     * may be a string or a function that resolves to a string.
+     * may be a string or a function that resolves to a string. When omitted, the configured
+     * `generateState` function provides it.
      * Widget open and cancel events can be observed with `on()`.
      *
      * @returns `true` when the widget was displayed.
      * @throws {SDKError} If user context data is missing or the widget script cannot be loaded.
      */
     showSimplifiedLoginWidget(
-        loginParams: SimplifiedLoginWidgetLoginOptions,
+        loginParams: SimplifiedLoginWidgetLoginOptions = {},
         options?: SimplifiedLoginWidgetOptions,
     ): Promise<boolean> {
         return this.#identity.showSimplifiedLoginWidget(loginParams, options);

package/src/consents.ts

@@ -0,0 +1,94 @@
+/* Copyright 2026 Schibsted Products & Technology AS. Licensed under the terms of the MIT license.
+ * See LICENSE.md in the project root.
+ */
+
+import { getConsentsSync, serializeConsents } from '@schibsted/consent-url-utils';
+
+const LINK_ACTIVATION_EVENTS = ['click', 'auxclick'];
+
+/**
+ * Reads consents from the Schibsted Sourcepoint integration, the default consent reader.
+ * Pages without the integration have no consents to forward, so they are skipped before
+ * `getConsentsSync` would warn about the missing consent manager on every login URL.
+ * @private
+ */
+export function readSourcepointConsents(window: Window): URLSearchParams | null {
+    if (!window._tcf_ && !window._scc_) {
+        return null;
+    }
+    return serializeConsents(getConsentsSync(window));
+}
+
+/**
+ * Sets the given parameters on a URL, replacing previous values of the same parameters.
+ * @private
+ * @param href
+ * @param consentParams
+ * @return - The URL with the parameters replaced
+ */
+export function replaceConsentParams(href: string, consentParams: URLSearchParams): string {
+    const url = new URL(href);
+    // Two passes on purpose: the reader may return repeated keys (e.g. `purpose=a&purpose=b`).
+    // A single `set()` pass would keep only the last value, and a single `append()` pass would keep
+    // stale values of the link. So first drop every stale value, then append all fresh ones.
+    consentParams.forEach((_, key) => {
+        url.searchParams.delete(key);
+    });
+    consentParams.forEach((value, key) => {
+        url.searchParams.append(key, value);
+    });
+    return url.href;
+}
+
+/**
+ * Finds the link that was activated by a click, including links inside open shadow roots.
+ * @private
+ * @param event
+ */
+function findActivatedLink(event: Event): HTMLAnchorElement | undefined {
+    const path = typeof event.composedPath === 'function' ? event.composedPath() : [event.target];
+    return path.find((node): node is HTMLAnchorElement => {
+        const link = node as Partial<HTMLAnchorElement> | null;
+        return !!link && link.tagName === 'A' && typeof link.href === 'string';
+    });
+}
+
+/**
+ * Refreshes consents of already rendered login links right before the browser follows them.
+ * Links are often generated before the user answers the consent dialog, so their consents are stale.
+ * The listener runs in the capture phase, before page handlers read the link.
+ * @private
+ * @param document
+ * @param options
+ * @param options.isLoginUrl - Tells whether a URL is a login URL to refresh
+ * @param options.getConsentParams - Current consent parameters
+ */
+export function refreshLoginLinksOnActivation(
+    document: Document,
+    {
+        isLoginUrl,
+        getConsentParams,
+    }: {
+        isLoginUrl: (href: string) => boolean;
+        getConsentParams: () => URLSearchParams;
+    },
+): void {
+    const refreshLink = (event: Event) => {
+        const link = findActivatedLink(event);
+        if (!link || !isLoginUrl(link.href)) {
+            return;
+        }
+
+        const consentParams = getConsentParams();
+        // Unknown consents never overwrite the ones the link was created with.
+        if (consentParams.toString() === '') {
+            return;
+        }
+
+        link.href = replaceConsentParams(link.href, consentParams);
+    };
+
+    LINK_ACTIVATION_EVENTS.forEach((type) => {
+        document.addEventListener(type, refreshLink, true);
+    });
+}

package/src/identity.ts

@@ -4,6 +4,11 @@
 
 import Cache from './cache.js';
 import { ENDPOINTS } from './config.js';
+import {
+    readSourcepointConsents,
+    refreshLoginLinksOnActivation,
+    replaceConsentParams,
+} from './consents.js';
 import { cloneDeep } from './object.js';
 import * as popup from './popup.js';
 import type RESTClient from './rest-client.js';
@@ -22,6 +27,7 @@ import * as spidTalk from './spid-talk.js';
 import type { AccountEventName } from './types/account.js';
 import type { LogFunction } from './types/common.js';
 import type {
+    ConsentReader,
     IdentityBeforeRedirectCallback,
     IdentityOptions,
     VarnishCookieOptions,
@@ -34,6 +40,7 @@ import {
     type SimplifiedLoginWidgetInitialParams,
     type SimplifiedLoginWidgetLoginOptions,
     type SimplifiedLoginWidgetOptions,
+    type StateGenerator,
 } from './types/login.js';
 import type {
     ConnectedSessionResponse,
@@ -42,7 +49,15 @@ import type {
     SessionResponse,
 } from './types/session.js';
 import { urlMapper } from './url.js';
-import { assert, isNonEmptyString, isObject, isStr, isStrIn, isUrl } from './validate.js';
+import {
+    assert,
+    isFunction,
+    isNonEmptyString,
+    isObject,
+    isStr,
+    isStrIn,
+    isUrl,
+} from './validate.js';
 import version from './version.js';
 
 declare global {
@@ -75,6 +90,8 @@ export class Identity {
     private readonly env: string;
     private readonly log?: LogFunction;
     private readonly callbackBeforeRedirect: IdentityBeforeRedirectCallback;
+    private readonly getConsents: ConsentReader;
+    private readonly generateState?: StateGenerator;
 
     // Caches
     private readonly sessionStorageCache: Cache;
@@ -109,10 +126,13 @@ export class Identity {
      * @param options.sessionDomain - Example: "https://id.site.com"
      * @param options.redirectUri - Example: "https://site.com"
      * @param options.env - Schibsted account environment: `PRE` (default), `PRO`, `PRO_NO`, `PRO_FI` or `PRO_DK`
-     * @param options.log - A function that receives debug log information. If not set,
-     * no logging will be done
+     * @param options.log - Receives debug logs and consent reader errors.
+     * Without it, consent reader errors are reported through console.warn.
      * @param options.window - window object
      * @param options.callbackBeforeRedirect - callback triggered before session refresh redirect happen
+     * @param options.getConsents - reads consents forwarded in login URLs.
+     * Defaults to the Schibsted Sourcepoint integration
+     * @param options.generateState - generates the OAuth state when login options do not provide one
      * @throws {SDKError} - If any of options are invalid
      */
     constructor({
@@ -123,6 +143,8 @@ export class Identity {
         log,
         window = globalWindow(),
         callbackBeforeRedirect = () => {},
+        getConsents = () => readSourcepointConsents(window),
+        generateState,
     }: IdentityOptions) {
         assert(isNonEmptyString(clientId), 'clientId parameter is required');
         assert(isObject(window), 'The reference to window is missing');
@@ -133,6 +155,12 @@ export class Identity {
         );
         assert(isStr(env), `env parameter is invalid: ${env}`);
 
+        assert(isFunction(getConsents), 'getConsents parameter must be a function');
+        assert(
+            generateState === undefined || isFunction(generateState),
+            'generateState parameter must be a function',
+        );
+
         spidTalk.emulate(window);
         this.window = window;
         this.clientId = clientId;
@@ -140,6 +168,8 @@ export class Identity {
         this.env = env;
         this.log = log;
         this.callbackBeforeRedirect = callbackBeforeRedirect;
+        this.getConsents = getConsents;
+        this.generateState = generateState;
 
         this.sessionStorageCache = new Cache(() => this.window && this.window.sessionStorage);
         this.localStorageCache = new Cache(() => this.window && this.window.localStorage);
@@ -189,6 +219,17 @@ export class Identity {
         this._unblockSessionCall();
     }
 
+    /** @internal */
+    enableLoginLinkRefresh(): void {
+        const { document } = this.window;
+        if (document && isFunction(document.addEventListener)) {
+            refreshLoginLinksOnActivation(document, {
+                isLoginUrl: (href) => this.isLoginUrl(href),
+                getConsentParams: () => this.getConsentParams(),
+            });
+        }
+    }
+
     addEventListener(type: AccountEventName, listener: EventListener): void {
         this.eventTarget.addEventListener(type, listener);
     }
@@ -802,7 +843,7 @@ export class Identity {
     /**
      * Generates the link to the new login page that'll be used in the popup or redirect flow
      * @param options
-     * @param options.state
+     * @param options.state - defaults to the value returned by `generateState`
      * @param options.acrValues
      * @param options.scope
      * @param options.redirectUri
@@ -819,7 +860,7 @@ export class Identity {
      * @return - The url
      */
     loginUrl({
-        state,
+        state = this.generateState?.(this.window),
         acrValues = '',
         scope = 'openid',
         redirectUri = this.redirectUri,
@@ -855,23 +896,65 @@ export class Identity {
             `the state parameter should be a non empty string but it is ${state}`,
         );
 
-        return this.oauthService.makeUrl('oauth/authorize', {
-            response_type: 'code',
-            redirect_uri: redirectUri,
-            scope,
-            state,
-            acr_values: acrValues,
-            login_hint: loginHint,
-            tag,
-            teaser,
-            max_age: maxAge,
-            locale,
-            one_step_login: oneStepLogin || '',
-            prompt: acrValues ? '' : prompt,
-            x_domain_id: xDomainId,
-            x_env_id: xEnvironmentId,
-            utm_campaign: originCampaign,
-        });
+        return replaceConsentParams(
+            this.oauthService.makeUrl('oauth/authorize', {
+                response_type: 'code',
+                redirect_uri: redirectUri,
+                scope,
+                state,
+                acr_values: acrValues,
+                login_hint: loginHint,
+                tag,
+                teaser,
+                max_age: maxAge,
+                locale,
+                one_step_login: oneStepLogin || '',
+                prompt: acrValues ? '' : prompt,
+                x_domain_id: xDomainId,
+                x_env_id: xEnvironmentId,
+                utm_campaign: originCampaign,
+            }),
+            this.getConsentParams(),
+        );
+    }
+
+    /**
+     * Reads the current consent parameters. A failing consent reader must not prevent a login,
+     * so the failure is logged and the login continues without consents.
+     * @private
+     * @return - Consent query parameters; empty when unavailable
+     */
+    private getConsentParams(): URLSearchParams {
+        try {
+            const consentParams = this.getConsents() || new URLSearchParams();
+            assert(
+                consentParams instanceof URLSearchParams,
+                `getConsents must return URLSearchParams but it returned ${consentParams}`,
+            );
+            return consentParams;
+        } catch (error) {
+            const log = this.log || console.warn;
+            log('Schibsted account SDK: could not read consents, logging in without them', error);
+            return new URLSearchParams();
+        }
+    }
+
+    /**
+     * Tells whether a URL is a login URL generated by this instance
+     * @private
+     * @param href
+     */
+    private isLoginUrl(href: string): boolean {
+        if (!isUrl(href)) {
+            return false;
+        }
+        const url = new URL(href);
+        const authorizeUrl = new URL(this.oauthService.makeUrl('oauth/authorize', {}, false));
+        return (
+            url.origin === authorizeUrl.origin &&
+            url.pathname === authorizeUrl.pathname &&
+            url.searchParams.get('client_id') === this.clientId
+        );
     }
 
     /**

package/src/index.ts

@@ -25,11 +25,13 @@ export type {
     LogoutRequestedEventDetail,
 } from './types/account.js';
 export type { AccountEnvironment, LogFunction } from './types/common.js';
+export type { ConsentReader } from './types/identity.js';
 export type {
     LoginOptions,
     SimplifiedLoginData,
     SimplifiedLoginWidgetLoginOptions,
     SimplifiedLoginWidgetOptions,
+    StateGenerator,
 } from './types/login.js';
 export type { HasAccessResult } from './types/monetization.js';
 export type {

package/src/types/account.ts

@@ -1,5 +1,10 @@
 import type { AccountBaseConfig, LogFunction } from './common';
-import type { IdentityBeforeRedirectCallback, VarnishCookieOptions } from './identity';
+import type {
+    ConsentReader,
+    IdentityBeforeRedirectCallback,
+    VarnishCookieOptions,
+} from './identity';
+import type { StateGenerator } from './login';
 import type { SessionResponse } from './session';
 
 /**
@@ -10,10 +15,22 @@ import type { SessionResponse } from './session';
 export type AccountConfig = Omit<AccountBaseConfig, 'env'> & {
     /** Schibsted account environment. Defaults to PRE. */
     env?: AccountBaseConfig['env'];
-    /** Receives debug log information. If not set, no logging will be done. */
+    /**
+     * Receives debug logs and consent reader errors.
+     * Without it, consent reader errors are reported through console.warn.
+     */
     log?: LogFunction;
     /** Callback triggered before a session refresh redirect happens. */
     callbackBeforeRedirect?: IdentityBeforeRedirectCallback;
+    /** Reads consents forwarded in login URLs. Defaults to the Schibsted Sourcepoint integration. */
+    getConsents?: ConsentReader;
+    /**
+     * Generates the OAuth `state` value used by `login()`, `loginUrl()`, and the simplified login
+     * widget when no explicit `state` is passed.
+     */
+    generateState: StateGenerator;
+    /** Refresh consents of rendered login links when clicked. Defaults to true. */
+    refreshLoginLinks?: boolean;
     /** Product or feature ids used by `hasAccess()` when no ids are passed to the method. */
     defaultProductIds?: readonly string[];
     /** Optional Varnish cookie setup applied during Account initialization. */

package/src/types/common.ts

@@ -2,11 +2,11 @@
 
 /**
  * Log callback used by the SDK for debug output.
- * Receives a pre-formatted log line.
+ * Receives a pre-formatted log line and, when reading consents fails, the error.
  *
  * @group Configuration
  */
-export type LogFunction = (message: string) => void;
+export type LogFunction = (message: string, error?: unknown) => void;
 
 /**
  * Supported Schibsted account environment keys.

package/src/types/identity.ts

@@ -1,4 +1,10 @@
 import type { AccountBaseConfig, LogFunction } from './common';
+import type { StateGenerator } from './login';
+
+/**
+ * Synchronously returns the current consents as query parameters; must not wait for the user's decision.
+ */
+export type ConsentReader = () => URLSearchParams | null;
 
 /**
  * Callback invoked before the SDK performs a full-page session refresh redirect.
@@ -9,10 +15,17 @@ export type IdentityBeforeRedirectCallback = () => void | Promise<void>;
  * Options accepted by the {@link Identity} constructor.
  */
 export type IdentityOptions = AccountBaseConfig & {
-    /** Receives debug log information. If not set, no logging will be done. */
+    /**
+     * Receives debug logs and consent reader errors.
+     * Without it, consent reader errors are reported through console.warn.
+     */
     log?: LogFunction;
     /** Callback triggered before a session refresh redirect happens. */
     callbackBeforeRedirect?: IdentityBeforeRedirectCallback;
+    /** Reads consents forwarded in login URLs. Defaults to the Schibsted Sourcepoint integration. */
+    getConsents?: ConsentReader;
+    /** Generates the OAuth `state` value when login options do not provide one. */
+    generateState?: StateGenerator;
 };
 
 /**

package/src/types/login.ts

@@ -1,3 +1,11 @@
+/**
+ * Generates the OAuth `state` value for a login flow. Receives the window the SDK was configured
+ * with and must synchronously return a non-empty string.
+ *
+ * @group Login & Widget
+ */
+export type StateGenerator = (window: Window) => string;
+
 /**
  * Options accepted by {@link Account#login} and related login URL helpers.
  *
@@ -7,8 +15,9 @@ export type LoginOptions = {
     /**
      * An opaque value used by the client to maintain state between the request and callback.
      * It's also recommended to prevent CSRF {@link https://tools.ietf.org/html/rfc6749#section-10.12}
+     * Defaults to the value returned by the configured `generateState` function.
      */
-    state: string;
+    state?: string;
     /**
      * Authentication Context Class Reference values. If omitted, the default account flow is used.
      * Supported values include `password`, `otp`, `sms`, `otp-email`, `eid`, `eid-no`, `eid-se`,
@@ -87,8 +96,9 @@ export type SimplifiedLoginWidgetLoginOptions = Omit<LoginOptions, 'state'> & {
     /**
      * An opaque value used by the client to maintain state between the request and callback.
      * It's also recommended to prevent CSRF {@link https://tools.ietf.org/html/rfc6749#section-10.12}
+     * Defaults to the value returned by the configured `generateState` function.
      */
-    state: string | (() => string | Promise<string>);
+    state?: string | (() => string | Promise<string>);
 };
 
 /**