it's explained in the first comment of the 10C Auth workflow.

//