The browser starts sign-in, NextAuth redirects to Google, Google authenticates the user, then redirects to the registered callback. NextAuth validates the OAuth response, runs callbacks, and establishes the app session. Use the NextAuth session to identify the user; do not treat Google's access token as your app session.