oauth: clean code