A method performed by an authorization service executing on an application server, the authorization service providing an authorization code request endpoint node, a callback endpoint node and a resource request endpoint node; the method comprising: receiving, by the authorization code request endpoint node, a request from an in-browser application for an authorization code for a specific user, wherein the request from the in-browser application for the authorization code comprises a client ID to identify the specific user, a uniform resource locator, URL, to which the in-browser application is re-directed, a scope parameter, and a state parameter; creating, using the URL to which the in-browser application is re-directed, the scope parameter, the client ID, and the state parameter, a session that re-directs the in-browser application to an authorization server; receiving (320, 322), by the callback endpoint node, the authorization code from the authorization server by way of the in-browser application; requesting an access token from the authorization server, the request for the access token being executed without involvement of the in-browser application, wherein requesting the access token comprises using a configuration associated with the specific user to provide the, URL, to which the in-browser application is re-directed, the client ID that identifies the specific user, and a client secret associated with the specific user for use in the request for the access token from the authorization server; receiving the access token from the authorization server; receiving a request from the in-browser application for a resource; using the access token to request the resource from a third-party resource server, the request to the third-party resource server being executed by the resource request endpoint node; and returning the resource to the in-browser application. receiving, by the authorization code request endpoint node, a request from an in-browser application for an authorization code for a specific user, wherein the request from the in-browser application for the authorization code comprises a client ID to identify the specific user, a uniform resource locator, URL, to which the in-browser application is re-directed, a scope parameter, and a state parameter; creating, using the URL to which the in-browser application is re-directed, the scope parameter, the client ID, and the state parameter, a session that re-directs the in-browser application to an authorization server; receiving (320, 322), by the callback endpoint node, the authorization code from the authorization server by way of the in-browser application; requesting an access token from the authorization server, the request for the access token being executed without involvement of the in-browser application, wherein requesting the access token comprises using a configuration associated with the specific user to provide the, URL, to which the in-browser application is re-directed, the client ID that identifies the specific user, and a client secret associated with the specific user for use in the request for the access token from the authorization server; receiving the access token from the authorization server; receiving a request from the in-browser application for a resource; using the access token to request the resource from a third-party resource server, the request to the third-party resource server being executed by the resource request endpoint node; and returning the resource to the in-browser application.