Solutionunvalidated
Perform the authorization-code-to-token exchange in the backend to keep tokens and the client secret off the client. Create/establish an app-specific user session (e.g., HTTP session cookies or tokens) and do not use the external provider access token directly for your backend authorization; generate/validate authorization specific to your APIs.
6667870f-51e6-45ee-9ec9-160e1f638685
Perform the authorization-code-to-token exchange in the backend to keep tokens and the client secret off the client. Create/establish an app-specific user session (e.g., HTTP session cookies or tokens) and do not use the external provider access token directly for your backend authorization; generate/validate authorization specific to your APIs.