It would be great to define which flags are required, based on which authentication flow is being used.