title: Passport Google strategy - when does the passport.use callback run? The callbackURL?
body: <p>I'm using Passport and working on the <a href="https://github.com/jaredhanson/passport-google-oauth2" rel="nofollow noreferrer">Google OAuth 2 strategy</a>. I'm having trouble understanding the flow.</p>
  
  <p>Here is the code in the <a href="http://www.passportjs.org/docs/google/" rel="nofollow noreferrer">official docs</a>:</p>
  
  <pre><code>var passport = require('passport');
  var GoogleStrategy = require('passport-google-oauth').OAuth2Strategy;
  
  // Use the GoogleStrategy within Passport.
  //   Strategies in Passport require a `verify` function, which accept
  //   credentials (in this case, an accessToken, refreshToken, and Google
  //   profile), and invoke a callback with a user object.
  passport.use(new GoogleStrategy({
      clientID: GOOGLE_CLIENT_ID,
      clientSecret: GOOGLE_CLIENT_SECRET,
      callbackURL: "http://www.example.com/auth/google/callback"
    },
    function(accessToken, refreshToken, profile, done) {
         User.findOrCreate({ googleId: profile.id }, function (err, user) {
           return done(err, user);
         });
    }
  ));
  </code></pre>
  
  <p>And then this for the routes:</p>
  
  <pre><code>// GET /auth/google
  //   Use passport.authenticate() as route middleware to authenticate the
  //   request.  The first step in Google authentication will involve
  //   redirecting the user to google.com.  After authorization, Google
  //   will redirect the user back to this application at /auth/google/callback
  app.get('/auth/google',
    passport.authenticate('google', { scope: ['https://www.googleapis.com/auth/plus.login'] }));
  
  // GET /auth/google/callback
  //   Use passport.authenticate() as route middleware to authenticate the
  //   request.  If authentication fails, the user will be redirected back to the
  //   login page.  Otherwise, the primary route function function will be called,
  //   which, in this example, will redirect the user to the home page.
  app.get('/auth/google/callback', 
    passport.authenticate('google', { failureRedirect: '/login' }),
    function(req, res) {
      res.redirect('/');
    });
  </code></pre>
  
  <p>Here's my understanding of the flow. User clicks a button to log in with google on the browser. Request is sent to <code>/auth/google</code>. Which calls <code>passport.authenticate</code>. From there, Google handles some stuff and once the user gives us permission to access their Google account, well, that's the part I'm not understanding.</p>
  
  <p>What's the next step? It seems like Google will send a response to the <code>callbackURL</code> we provide. But in that case, when does the callback to <code>passport.use</code> run? That callback is accepting <code>accessToken</code>, <code>refreshToken</code>,  and <code>profile</code>, so it seems like it is the one receiving the response from Google, not the <code>callbackURL</code>.</p>