OAuth without the diagram

OAuth is not a login mechanism, although it is mostly used as the base of one. It is a way for a user to grant your application limited access to their account somewhere else without handing over the password. The token you receive says what you may do and for how long; OpenID Connect is the layer bolted on top that also tells you who the user is.

The authorisation code flow: you redirect the user to the provider with your client id, a scope list, a redirect URI and a random state value. They authenticate there, on the provider's domain, and are sent back to your redirect URI with a short-lived code. Your server then exchanges that code plus its client secret for tokens, server to server. The password never touches you, and the code alone is useless without the secret.

State exists to stop CSRF on the callback: you generated it, you check it comes back unchanged, so an attacker cannot make a victim's browser complete an authorisation the attacker started. PKCE does the same job for clients that cannot keep a secret, binding the code exchange to a proof only the original requester holds. These are the two parameters people leave out when hand-rolling a flow, and they are the two that matter.