OAuth Connect
The OAuth2 authorization-code flow with refresh, per user - the flow behind every 'connect your Google account' button. Single-use CSRF state, tokens sealed with AES-256-GCM (encrypt_value) and never stored in the clear, transparent refresh driven by an absolute expires_at, and correct handling of providers that send refresh_token only on the FIRST consent.