I'm currently architecting a way I can implement an auth token exchange in my application and prevent this token from being exposed.
For example, user wants to grant access to a 3rd party application that first requires them to be directed, log in/confirm the connect, and then redirected back with a valid auth token for future api requests to that 3rd party app.
My goal is to handle this flow with server actions, once the token is given, update the users information in the database but not return it. Is that possible or am I thinking of this wrong?
Cheers.