An arbitrary string to maintain state between this request and the callback, e.g. it might contain a session ID from your application. The value should also contain a random component, which your application checks to prevent cross-site request forgery.