Yeah, pretty much. We have a hidden iframe silently refreshing tokens. Don't ask me why, I thought the whole point of OAuth was that example.com was allowed to

Yeah, pretty much. We have a hidden iframe silently refreshing tokens. Don't ask me why, I thought the whole point of OAuth was that example.com was allowed to access identity.com. Instead, example.com opens a hidden identity.com iframe and does what do I know? At my old job, users could specify their own IdentityProvider for their instance, which added a whole layer of complexity. Now we have found out that a different team has implemented their side of OAuth completely wrong: Their device flow ("Open in app and enter 56474") doesn't poll automatically. Instead, user have to click "try now" manually. The whole auth is lost when the device restarts. I'm not surprised Microsoft lost control of Bing because they implemented OAuth wrong for one of the services displayed there.