I'm trying to write Apex code that'll call an external API. The API is using OpenID Connect for authentication, meaning I'll have to first give consent in order to get an authorization code, then exchange that for an access token and THEN use that as Bearer token to call the actual API endpoint I want. The entire flow is described on this page: https://developer.mobilepay.dk/developersupport/openid-get-started
Normally, I would use Named Credentials for easy callouts, however in this case, the authorize- and token-steps are using PKCE code challenge, which means I'll have to add at least one extra header to calls to the authorize endpoint (the codechallenge) as well as to the later calls to the token endpoint (the codeverifier). I cannot see any way of using Named Credentials - or Auth. Providers - to do this.
I also tried looking into storing tokens in Custom Metadata, but that won't work since I cannot DML Custom Metadata and each access token is only valid for 5 minutes before expiring and needing the refresh token, so I'd need some automated way of refreshing it.
What would be the most sensible way to accomplish this? All the documentation I can find about Salesforce + OpenID is talking about how to use OpenID providers to log INTO Salesforce, but I'm attempting to go in the other direction: Using OpenID to call OUT of Salesforce to a third-party API.