Check your incoming request for 'code' as query parameter. If so, authenticate and redirect to your application (redirect_url) without query params. If not, authenticate.