Is it safe to pass the token in the callback url to use it after the redirect?

Question

User identification

In general, there is an application server that communicates with the client via the REST API, passing the token.
There is a method for binding a third-party service, a link + callback leads to the service, to which it will return. So is it possible to pass a token to this callback so that the user is authorized upon return.
Is it possible to do this at all?

Answer 1

No, you can't do that.
The token must be generated only by your REST API.
After authorization, the site needs to get a TEMPORARY! authorization token from your service and then pass along with the parameters to the callback-URL, then again by your service - check all the parameters and, if they match, authorize the user.