title: How to handle access token in OAuth authorization flow?
body: <p>I'm building an app that uses <a href="https://developer.github.com/apps/building-oauth-apps/authorizing-oauth-apps/" rel="nofollow noreferrer">Github OAuth</a>, which uses the authorization flow. This is my first time implementing OAuth, so I just wanna make sure i'm doing everything right. Im imagining something like:</p>
  
  <p>User clicks <code>Continue with Github</code>. We call the GH url and provide a frontend app redirect uri. The app accepts a <code>code</code> and sends it to the server. It exchanges it for an access token, then gets the user from an API, gets the id and checks if that exists in the database. If it does, it creates a JWT token and sends a response like [<code>token</code>, <code>...</code>].</p>
  
  <p>I hope that's how it should be.</p>
  
  <p>The question is what to do if the user doesn't exist. In that case I also want to ask the user for a username in my app (as well as accepting ToS etc). So I have two options: sending back the code or sending the access token.</p>
  
  <p>If I send the code, once the user fills the username, the server will be querying for the access token again. Seems repetitive to me.</p>
  
  <p>But since the access token is a function of my app secret, I'm hesitant for it to be on the client. Although these convince me otherwise:</p>
  
  <ul>
  <li>access token should be a signature of the app secret, and shouldn't leak the app secret (right?)</li>
  <li>we can assume app <code>store</code> is secure, because, well, it's the app's state</li>
  <li>connection is SSL</li>
  </ul>
  
  <p>So what's the best practice? Cheers!</p>