I have managed to set up oauth2 for user registration and authentication using Google oauth2 API as provider.

My code for oauth2 provider callback looks like this:

  def callback(conn, %{"provider" => provider, "code" => code}) do
    client = get_token!(provider, code)
    user = get_user!(provider, client)

    user_params = %{
      first_name: user.body["given_name"],
      last_name: user.body["family_name"],
      email: user.body["email"],
      provider: "google"
    }

    changeset = User.changeset(%User{}, user_params)
    create(conn, changeset, client)
end

  def create(conn, changeset, client) do
    case insert_or_update_user(changeset) do
      {:ok, user} ->
        conn
        |> put_flash(:info, "Thank you for signing in!")
        |> put_session(:current_user, user)
        |> put_session(:access_token, client.token.access_token)
        |> redirect(to: "/")
      {:error, _reason} ->
        conn
        |> put_flash(:error, "Error signing in")
        |> redirect(to: page_path(conn, :index))
    end
  end

  defp insert_or_update_user(changeset) do
    case Repo.get_by(User, email: changeset.changes.email) do
      nil ->
        Repo.insert(changeset)
      user ->
        {:ok, user}
    end
  end

As can be seen I am loading the user object by the email address provided by Google’s oauth2 and signs him into the site (put_session(:current_user, user)) after loading him by the given email address.

Is this correct, secure and satisfactory?

At the same time I wonder, what is the use of the access_token? Is it something that I need to store in the users tables and check for its validity on each subsegment resource request made by the user?