Confirm

reading the link…

This page needs JavaScript to read the key out of the address bar. Nothing has changed. Open the link in a normal browser window, or use the curl command from the approval page.

This is the only step that changes anything, and it is a POST — following a link cannot do it. The key is single-use and expires 60 minutes after the page that issued it.