This is misleading. There is 2 types of OAuth2 "flow", sometimes called server-flow and client-flow. Server-flow is the mechanism where a callback is registered

This is misleading. There is 2 types of OAuth2 "flow", sometimes called server-flow and client-flow. Server-flow is the mechanism where a callback is registered with the auth server, but all comms and the initial auth have to go through some other server, which is just being setup for you in this case. Client-flow is the far more interesting flow, for me, anyway. There the browser client gets the token directly from the auth server, that really is serverless. The key advantages of client-flow are you don't need the immediate server (less cost for you) and you don't have to see the data if you're using a third-party storage (better security and privacy). You do need to be careful with security issues around the auth token itself, in server-flow you store the token on the server and have the session bind you to that token. Stealing a session is harder than stealing a token. I know of two implementations to date: Google's Official JavaScript Client library [0] Dropbox's Unofficial JavaScript library [1] [0] https://code.google.com/p/google-api-javascript-client/ https://code.google.com/p/google-api-javascript-client/ [1]https://github.com/dropbox/dropbox-js https://github.com/dropbox/dropbox-js