title: How can i safely pass access token generated from Google OAuth to a NodeJS REST API?
body: <p>I am creating two application : 
  1. Chrome extension for gmail.
   2. It's IOS version</p>
  
  <p>Now, since both the applications have same behavior and uses same google apis extensively, i decided to create a single project in google cloud platform for both. Now, when creating credentials, what will be my application type? I see both '<strong>IOS</strong>' and '<strong>Chrome App</strong>' under application type. Should i  generate two Client IDs for chrome app and ios app?</p>
  
  <p>To use single Client ID, i also tried creating a Node REST API (created a new project and set application type to '<strong>web application</strong>' in google cloud platform) that will be used by both of my application to make request to google apis? But the authorization process includes, setting a callback url to get the authorization code and later use this code to get the access token. I guess this is not feasible for a REST API. Where should i keep the authorization part? In the application itself and later send the access token to my rest api? Is it possible?</p>
  
  <p>I am very much confused about how should i start. Please could anyone suggest a better way to do this?  </p>