Not sure how I missed your response, that looks awesome and gives me lots of ideas!
I do think it should be more baked into dbAuth, though, especially because it’s not really general purpose and rewrites a bunch of dbAuth functionality - it would be useful for maintainability to be able to access those directly. I’m specifically thinking that the oAuth integration could mirror the structure of the Webauthn integration.
On the same line, I was thinking the dbAuth “client” parameter, which is currently just used for Webauthn, could be used to expose further functionality such as this - what’s your take on that? It always felt kind of weird to me that we have this param to expose auth implementation specific items but designed its usage to only work for this one item.
Even if not, I would love to see this become an official Redwood plug-in to make it more accessible.
Let me know what you think!
EDIT: actually, I have an idea on how to reuse the dbAuth stuff while include this as a custom auth provider by just passing the authHandler into the oAuthHandler in the redwood project’s auth function. Starting to understand more about how the framework is structured as I stumble through it 
EDIT: @rob your cookbook looks great! I’m leveraging it in my reusable solution, which I think you’re gunna like It’s coming along nicely, just wrapping things up, then need to write up usage docs and publish it to NPM, at which point I’ll make a new post in this community and the discord. At launch, it’ll integrate into any RW app very much the same way that dbAuth is integrated, be extremely easy to configure, and allow for Google, Apple, and GitHub. It supports signup, login, and linking to as many providers as a user wants.
It’ll also be providing components with signup/login/link buttons so that a user can onboard the library in <10 minutes.
One minor nit re your cookbook: you’re using status code 302 to handle your redirects from the API side back to the Web side, but I feel 303 is more idiomatically correct. Although I believe browsers generally treat these the same, so it doesn’t really matter.
EDIT: Just released the OAuth plugin! 🎉 Announcing dbAuth OAuth Plugin v1.0.0 - easily enable Sign in with Apple, GitHub, Google, and more!