Trying to see how client-side javascript might grab an oauth token, so that all API calls can simply contain that token.
I can't.
Seems like API server needs to use a session ID and keep a map of token and other state against that ID internally.
Doesn't bode well for another non-web client of the API.
JSON Web Tokens seem to be a good idea. API can authenticate user with OAuth provider, and then issue a JWT which will be used in subsequent API requests. It holds expiry and basic details and is signed by the API server. That seems easier for other API clients to deal with, and the OAuth provider becomes just one of many ways to authenticate.