 <p><code>callbackURL</code> tells facebook on which external address could it call back your application after the user completes the authentication form, whereas <code>sucessRedirect</code> is the pair of <code>failureRedirect</code> are internal routes executed depending on the authentication outcome.</p> <p><code>passport.authenticate(...)</code> orchestrates the whole process. The "happy" flow is roughly the following:</p> <ol> <li><code>passport.authenticate(...)</code> detect that there is an unauthenticated user tries to access the given route, redirects it to facebook oauth;</li> <li>if facebook auth was successfull your verify callback is called (this is your "Function A"), which should match the user by facebook userid in your internal user database and set things up accordingly (typically create a session for the user);</li> <li>If everything goes well the user gets redirected to <code>successRedirect</code>, which is usually an internal route like <code>/profile</code>, from that point you could use user data you looked up at the previous step.</li> </ol> <p>I hope that explains it.</p>