It binds the callback to the intended connection attempt and helps prevent request-forgery or account-linking confusion.

In trusted server-side code that can protect the app secret and resulting tokens.