I have an SPA, where the user will login using Microsoft Entra using authorization code flow. Client is public, so I registered my app as SPA client, following Microsoft oath code flow documentation. Let’s assume I have no API in this project, because I want to use public flow and the API should not be needed since we are using PKCE instead of client secret.