The Parts People Get Wrong

The state parameter is not optional. You generate a random value, send it with the request, and check it matches on the way back. Without it, an attacker can start their own flow and trick a signed-in person into completing it, attaching the attacker's provider account to the victim's account on your site.

Use the library's implementation. This is a solved problem and hand-rolling the flow is how the state check gets skipped.

Handle the cases beyond the happy path. The person declines at the provider. The provider returns an error. The email already exists on your site with a password. The provider's email changes later. The token expires while they are using your application.

Each one is a real path somebody will take, and each one that is unhandled is either a confusing dead end or a security hole.