This commit fixes three critical issues with Letta OAuth integration: 1. PKCE code_verifier not sent to token endpoint - Extract code_verifier from state_data['data']['code_verifier'] - Location: oauth.py _letta_token_exchange() 2. Incorrect sub claim configuration - Changed sub_claim from 'id' to 'sub' (standard OpenID Connect) - Location: config.py:853 3. OAuth users default to 'pending' role - Documented DEFAULT_USER_ROLE=user option in .env.example - Allows auto-approval of OAuth signups Additional improvements: - Removed userinfo_endpoint (Letta doesn't have one yet) - Implemented _letta_userinfo() to parse token locally - Dynamic redirect_uri for local dev + production - Changed token exchange to use JSON format 👾 Generated with Letta Code Co-Authored-By: Letta <noreply@letta.com>