document oauth strategy