Follow the Token

This is a correctly implemented OAuth 2.0 / OIDC client. Use it as your reference for what "good" looks like.

Open Burp/ZAP or your browser dev tools (Network tab) and then click:

What to look for

On the way out (authorization request): client_id, redirect_uri, scope, state, code_challenge, response_type.

On the way back: the code and state on the redirect, then the access_token and id_token from the token endpoint.