Current hack for a login with a client side, PKCE (no client secret)

authorization_code

flow login without a

<form>

implementation which would redirect the browser to the POST destination:

export const login = (flow: string, username: string, password: string, csrf_token?: string) =>
    oryApi.updateLoginFlow(
        {
            flow,
            updateLoginFlowBody: {
                method: 'password',
                identifier: username,
                password,
                csrf_token,
            },
        },
        {
            validateStatus: (status) => status === 422,
        },
    ) as Promise<AxiosResponse<ErrorBrowserLocationChangeRequired>>;

after which the contents of the error are used to actually update

window.location.href

redirecting the user