A single-use nonce to put in the message you are about to sign

Expires shortly and is consumed by the first proof that presents it. It is a LINK nonce: it cannot be spent at a login endpoint, so the signature you collect is not a session. ?purpose=authorize issues the nonce for the login wallet's authorisation instead — a separate pool.