Thanks for the suggestion! This is on our product roadmap.

One way to track users is also to specify approve/reject redirect urls with random tokens (though we agree that private metadata is more ergonomic in this case).