Generally it is not recommended to send custom parameters to the /authorize endpoint. There is a login_hint parameter however, which is part of the standard. Generally it is used for passing the email address that the user is trying to log in as, but can also be used for this type of scenario where you want to tell the login page how to render. So, if you switch to login_hint instead of mode, then you are sticking more with that OIDC standard. Just beware that you should “validate” the value in login_hint on the login page to make sure it is either signUp or login before passing as the parameter to lock.