I got this working using Authentication Code Flow with PKCE by:

• Reading the code hash from the URL

• Calling msalInstance.acquireTokenByCode with

  • { code, authority, scopes, codeVerifier }