OAuth 2.0 authorization and token exchange