OAuth flow

I think we should check anyway, good catch