Hello, I'm not sure what the secure way of setting up auth with Google is. All I need is for the user to authenticate with Google, then I will get the access and refresh tokens for authorizing Google API actions on the user's behalf, and will save those tokens to the backend for offline actions (I have some async workflows that need to run while the user is not actively online).

Is it ok to do this all in a server component?

My current approach:
In a server component, I'm creating a google.auth.OAuth2 client using the googleapis library. This client generates an auth url, which I have the user navigate to, sign in, and then will return to the page with a token. Once I get the access and refresh tokens, I'll call a Lambda backend to store these in my app's DDB. Is this a valid approach? anything I need to be wary of?