Server-side sign-in against one confidential dashboard app client. Every call carries the client's SECRET_HASH, so none of this can run in a browser.
SECRET_HASH
Seconds until the access and ID tokens expire.
Absent from a refresh, which keeps the refresh token it was given.
Server-side sign-in against one confidential dashboard app client. Every call carries the client's
SECRET_HASH, so none of this can run in a browser.