how does spotify do oauth(+open id connect) from the desktop app?

Question

I understand what the workflow would be from the webpage, but how does oauth+open id work for desktop apps as they cannot open a browser page within the app. I see that when I click on log in with facebook in the spotify app, it opens facebook in the browser and returns the control back to the app once the user interaction part is over. But what happens under the hood?

This would be the regular workflow from a webpage based on my understanding from here: https://www.youtube.com/watch?v=996OiexHze0

1. User clicks authorize with xyz on app
2. xyz authorization page is opened for authorization grant
3. User interaction to allow scope of grant, in this the scope is opend ID connect or some thing like that for login
4. callback page on app is opened with authorization grant from xyz
5. In the backchannel, app communicates with xyz along with the authorization grant for open id login to get the access token from xyz

But considering a desktop app like spotify which cannot open webpages and receive the response back from the service provider (facebook) with the authorization grant, what would be the workflow under the hood?

Answer 1

They use a concept sometimes called "Universal Links" or "App links". Here's an example of how those are implemented in Windows: https://docs.microsoft.com/en-us/windows/uwp/launch-resume/web-to-app-linking and here's one for iOS apps: https://developer.apple.com/ios/universal-links/

The idea is that these are HTTPS URLs that can be mapped to particular applications in your environment. Assuming they are mapped properly, the app will launch rather than a browser. However, if the app isn't installed / mapped properly, then (since it is still just an HTTPS url) the browser will load the URL instead. The URL they are given contains the auth code necessary to complete the OAuth grant, just as if it were a normal web application.