Return JWT token to javascript SPA from oauth login

In the end I ended up with the following login flow

User is directed to Oauth providerOauth provider returns an access token to the clientthe client sends the access token to my apimy api sends a renew request to the Oauth providerthe Oauth provider validates the token and returns a new one to my apimy api exchanges the access token for a jwt tokenmy api returns the jwt token to the client

In my opinion it is the only correct way to authenticate SPA applications, and it is important to renew the Oauth token the client provides rather than blindly exchanging for a jwt as you can't trust the client, and is better than issuing redirects from the api that isn't very restfull

Instead of dealing with 2 services, your spa should talk to a single auth service in your backend. You register your service as the oauth callback and you handle oauth/jwt as you described. Your auth service can also be the decision point for user (re-)authentication. Since your frontend calls your backend directly, you can now return the json payload back to your web/mobile caller.