Web Engineering
OAuth 2.0 Across Google, Microsoft and Zoom
Date Published
Three providers, one session
Each provider differs in scopes, refresh semantics and account-linking rules. Normalising them behind a single session model is what keeps the application code provider-agnostic.
Handling the edge cases
Silent token refresh, revoked grants and provider-side email changes are the cases that break SSO in production. Treat them as first-class flows rather than error paths.