Mist follows a traditional OIDC redirect flow, with the exception that no third party is needed to verify the user’s identity.