authorization_params. If I add a state keyword, then it gets forwarded to Assent (though that is deprecated) and passed through the flow. So far, that works for passing the state back and forth between redirects! I can pass the invite code back and forth in the state (though I think I'll also want to include a nonce, and Assent will verify it).