I’m building an iOS app (SwiftUI) that needs to access Google Calendar, with a Django backend handling token management. I’m unsure about the correct OAuth flow implementation. My main questions are:

1. Client Configuration: Do I need both iOS and web service clients in Google Developer Console, or just a web service client? What’s each client’s role in the OAuth flow?

2. Authorization Flow:

• User taps button in iOS app to request Google Calendar access
• App presents ASWebAuthenticationSession
• User authenticates, app receives authorization code
• Django backend exchanges code for tokens and stores them
  Is this flow correct? What are the specific responsibilities of the iOS app vs. the Django backend?

3. URL Generation:
   Should the OAuth URL be generated by the iOS app or the Django server? If by the server, how should the iOS app request and use this URL?
4. Redirect URIs: How should I handle redirect URIs in this setup? Should I use a custom URL scheme for the iOS app, a universal link, or should the redirect go to the Django backend? How does this choice affect the overall flow?

I’d appreciate a brief explanation of the correct OAuth flow for this architecture, focusing on the interaction between the iOS app and Django backend.

Tech Stack:

• iOS App: SwiftUI
• Backend: Django
• OAuth Provider: Google (for Calendar access)