OIDC Login Initiation
An LTI® 1.3 launch does not begin with the payload. It begins with the platform posting a small request to the tool's login initiation URL, saying only that a launch is starting and who it is for.
The tool replies with an authentication request, and only then does the platform send the ID Token. This third-party initiated login flow comes from OpenID Connect.
The purpose is to let the tool set up state and prove the launch was not replayed, which the single signed form post of LTI® 1.1 could not do.
