That’s not a bad idea, and sounds similar to how I’ve worked with oauth providers in past day jobs.