When requesting the Access token from the token URL via the authorization-code flow, the initial referer is stored in redis. The specified referrer_uri when making the token call should be the same as the intially set referrer (/oauth2Success/). A provider doing a check on the referrer will reject token request