title: User/Session creation based on Github OAuth
body: <p>I am working on the implementation auth or session (doesn't matter for now) service for my project API. I decided also to support account/session creation workflow based on Github OAuth (Device flow because the client is a CLI tool).</p>
  <p>So, in general, my workflow should be next:</p>
  <ol>
  <li>User requests the auth/session service (not directly but I skip that for simplification)</li>
  <li>auth/session service requests authorization and receives user token by Github OAuth</li>
  <li>auth/session service requests the user data based on the received token</li>
  <li>auth/session service creates userrecord / session based on user data and returns this token/session to the client</li>
  <li>The client can use the token returned from auth/session service to call my custom API.</li>
  </ol>
  <p>Sounds clear, I have two approaches but all of them have downsides, and I cannot deside what to choose:</p>
  <ol>
  <li>The first approach is perform Github AOuth on Auth/Session service, there is the workflow diagram: <a href="https://i.stack.imgur.com/cXEor.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/cXEor.png" alt="enter image description here" /></a>
  The downside of this approach that I need to poll Github server from my Auth/Session service and poll Auth/Session service from the CLI, otherwise I doesn't have option to pass token for my API to CLI.</li>
  <li>The second approach is perform Github AOuth on the cliend side (CLI app). There is the workflow diagram:<a href="https://i.stack.imgur.com/d0XK8.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/d0XK8.png" alt="enter image description here" /></a><br />
  The downside of this approach is that client will need to explicitly pass github token to Auth/Session service. Also we open details of implementation, because end to end scenario to receive Github token will be performed on client and all that Auth/Session service need it just Github API token. It confuse me a little bit... Also, in next generation, the application will have native app and web clients, in that case we will need perform fully separate workflows for each client type.</li>
  </ol>