Step 1: Let the user know what you’re doing and request authorization

Since the OAuth flow involves directing your users to the website of the API provider to obtain authorization, it’s a best practice to let them know in advance what will happen. You can do this by displaying a message, along with a link (the “Add tasks to your Google Tasks” link in Figure 2-2).

After the user initiates the flow, your application will need to send the user’s browser to the OAuth authorization page (as seen in Figure 2-3). This can be done either by sending the main browser window directly to the authorization endpoint or by creating a pop up. On this page, the API provider will present the user with a request to approve the application’s ability to access the user’s data. Of course, the user needs to already be signed in to the API provider, or they will be prompted to authenticate before being asked to grant access to their data.