I understand what the workflow would be from the webpage, but how does oauth+open id work for desktop apps as they cannot open a browser page within the app. I see that when I click on log in with facebook in the spotify app, it opens facebook in the browser and returns the control back to the app once the user interaction part is over. But what happens under the hood?
This would be the regular workflow from a webpage based on my understanding from here: https://www.youtube.com/watch?v=996OiexHze0
- User clicks authorize with xyz on app
- xyz authorization page is opened for authorization grant
- User interaction to allow scope of grant, in this the scope is opend ID connect or some thing like that for login
- callback page on app is opened with authorization grant from xyz
- In the backchannel, app communicates with xyz along with the authorization grant for open id login to get the access token from xyz
But considering a desktop app like spotify which cannot open webpages and receive the response back from the service provider (facebook) with the authorization grant, what would be the workflow under the hood?