title: How to use OAuth2 Browser based authentication, and then verify the record on the server
body: <p>I have a browser-based app (single page, AngularJS) and am using hello to use third party signin such as Google, FB, Soundcloud, etc.</p>
  
  <p>My app uses a PHP API server.</p>
  
  <p>What's a good way to have the user able to login using Google, but also verify the user on the server side?</p>
  
  <p>I was considering:</p>
  
  <ul>
  <li>The browser app performs an implicit grant with google/fb/etc</li>
  <li>I then transfer the access_token from the client to the server, then use, for example, a google-api-php-client with my <code>app id</code>, secret and the user <code>access_token</code>?  Using their API such as <code>/me</code>? (which grant type would this be?)</li>
  <li>Retrieve some key from the third-party (facebook_id, email, etc), match it against a user in my database, and then consider the user authenticated?</li>
  </ul>
  
  <p>Also, should I perform this on each API request?  Or should I just stash the <code>access_token</code> for a bit and assume that the user is still valid until the key expires?</p>