@thomasfuchs at a higher level what are you trying to do? I think a large part of the issue will be grabbing the final issued token at the flow because it's the consuming app that has the responsibility of resolving any sort of one-time-token from the auth provider into an ID token or Auth token.