A method performed by an authorization service executing on an application server , the authorization service providing an authorization code request endpoint node , a callback endpoint node and a resource request endpoint node ; the method comprising: receiving , by the authorization code request endpoint node , a request from an in-browser application for an authorization code for a specific user, wherein the request from the in-browser application for the authorization code comprises a client ID to identify the specific user, a uniform resource locator, URL, to which the in-browser application is re-directed, a scope parameter, and a state parameter; creating , using the URL to which the in-browser application is re-directed, the scope parameter, the client ID, and the state parameter, a session that re-directs the in-browser application to an authorization server ; receiving , by the callback endpoint node , the authorization code from the authorization server by way of the in-browser application; requesting an access token from the authorization server , the request for the access token being executed without involvement of the in-browser application , wherein requesting the access token comprises using a configuration associated with the specific user to provide the , URL, to which the in-browser application is re-directed, the client ID that identifies the specific user, and a client secret associated with the specific user for use in the request for the access token from the authorization server ; receiving the access token from the authorization server ; receiving a request from the in-browser application for a resource ; using the access token to request the resource from a third-party resource server , the request to the third-party resource server being executed by the resource request endpoint node ; and returning the resource to the in-browser application . receiving , by the authorization code request endpoint node , a request from an in-browser application for an authorization code for a specific user, wherein the request from the in-browser application for the authorization code comprises a client ID to identify the specific user, a uniform resource locator, URL, to which the in-browser application is re-directed, a scope parameter, and a state parameter; creating , using the URL to which the in-browser application is re-directed, the scope parameter, the client ID, and the state parameter, a session that re-directs the in-browser application to an authorization server ; receiving , by the callback endpoint node , the authorization code from the authorization server by way of the in-browser application; requesting an access token from the authorization server , the request for the access token being executed without involvement of the in-browser application , wherein requesting the access token comprises using a configuration associated with the specific user to provide the , URL, to which the in-browser application is re-directed, the client ID that identifies the specific user, and a client secret associated with the specific user for use in the request for the access token from the authorization server ; receiving the access token from the authorization server ; receiving a request from the in-browser application for a resource ; using the access token to request the resource from a third-party resource server , the request to the third-party resource server being executed by the resource request endpoint node ; and returning the resource to the in-browser application . <EOS>