Login on Native or Web Client, API Calls from Native or Web Client
This is the simplest model where the auth is done on the client all calls also run through the client. There are three possible configurations in this model:
Native or web client authenticates and uses the returned short or long-term token to make calls.
Web client authenticates, exchanges the short-term token for a long-term token via a server, token is sent back down to the web client and then the web client and makes calls with the long-term token.
Web client authenticates, exchanges the short-term token for a long-term token via a server, server does code exchange and the client exchanges the code for a long-term token, makes calls with that token. (Used rarely.)