authorization code provided by salesforce, to fetch access token

defines if the salesforce domain belongs to a sandbox, if not present, it is considered a production domain

if the action is performed by an user of a privileged org, this is the target organization to add the account

signed OAuth state echoed back from the Salesforce redirect; when present, the backend derives the environment from its claims instead of the isSandbox flag

Stable machine-readable error code (e.g., EMAIL_NOT_VERIFIED). Optional; populated by endpoints that distinguish multiple error states behind one HTTP status.