"Just use OAuth" is one of those instructions that's easy to follow and hard to actually understand. This is a complete reference — not a quick overview — covering what actually happens, in order, when a user clicks "Login with Google," what a JWT really is once your app has one, every other OAuth grant type you'll encounter outside that one flow, and the specific attacks each piece of the protocol exists to defend against. Work through it in order, or jump to the section you need from the sidebar.