OAuth sign-inUser to Browser: Sign in; Browser to Provider: Authorize; Provider to Browser: Redirect with a code; Browser to App: GET /callback; App to Provider: Exchange the code; Alt: Code is valid; Provider to App: Access token; App to Browser: Signed in; Else: Expired; App to Browser: Try again; Note: The token never reaches the browserUserUserBrowserBrowserAppAppProviderProvideralt[Code is valid][Expired]User → Browser: Sign in1. Sign inBrowser → Provider: Authorize2. AuthorizeProvider → Browser: Redirect with a code3. Redirect with a codeBrowser → App: GET /callback4. GET /callbackApp → Provider: Exchange the code5. Exchange the codeProvider → App: Access token6. Access tokenApp → Browser: Signed in7. Signed inApp → Browser: Try again8. Try againNote: The token never reaches the browserThe token never reaches thebrowser