The app server requesting access has to be configured with the identity provider. Part of that is a redirect URL, which the identity provider redirects the clie

The app server requesting access has to be configured with the identity provider. Part of that is a redirect URL, which the identity provider redirects the client to once the authentication is ok. The URL is to an endpoint of the app server. When the id provider redirects, it includes the authorization code as an URL parameter or similar, so the app server can pick it up and call the id provider to exchange the authorization code for an access token. At least that's how I remeber it off the top of my head.