title: What is the best practice working with OAuth, express and React.js
body: <p>I don't quite understand the workflow of Third-Party Authentication.
  I am trying to create an SPA application with back-end on express and front-end on React.
  The application should handle webhooks from GitHub API.</p>
  
  <p>I've managed to authenticate the user on my back-end but how do i send the access_token to the front end? (So i can do ajax on front-end).
  GitHub allows to send ajax requests with token bearer.
  Example:
  <code>curl -H "Authorization: token OAUTH-TOKEN" https://api.github.com/user</code></p>
  
  <p>Do i send the JWT token instead to the front-end via query string? But then what do i do?</p>