OAuth flow can certainly open a popup (or new tab if that's how your browser is configured). After you login it will use a redirect but that might be hidden fro

OAuth flow can certainly open a popup (or new tab if that's how your browser is configured). After you login it will use a redirect but that might be hidden from the user. Pop-up blockers don't work when the user clicks "login". It's not suspicious at all and I would say best practice. In any case, you always need to make sure the domain is trusted. That's a lot easier if your browser puts all windows in tabs.