Questions about OAuth Endpoint