I used the JWT package which stores it in the database and it’s time restricted. You can then also choose to limit the usage from within the application too. I didn’t url restrict it as we didn’t need too really and just created a 5minute token that was created in the redirect controller. So we went internally to a controlled which took the redirect uri, generated the token and redirected the user to the new url with the JWT in toe, as such authenticating the user. Similar to how react etc works with JWT’s.