Take a look at this SO answer: fooobar.com/questions/1498911 / ...
Hybrid applications do not have a public URL that OAuth can redirect to, but there are some tricks you can do with a child browser plugin to “crack” them (see the first link). You can redirect the OAUTH provider to a dummy URL that the child browser can intercept and parse the token from the URL (there are even some security issues). OAuth2 becomes even more difficult when configuring not to put the token in the redirect URL and instead put it in the body or in the header. The child browser does not disclose this data, which means that capturing it requires another user-defined work of its own, if this is your only route.
source share