code: def _process_callback(self, statefield):
          
          # retrieve session and callback variables
          try:
              session_csrf_token = session.get('oidc_csrf_token')
  
              state = _json_loads(urlsafe_b64decode(request.args['state'].encode('utf-8')))
              csrf_token = state['csrf_token']
  
              code = request.args['code']
          except (KeyError, ValueError):
              logger.debug("Can't retrieve CSRF token, state, or code",
                           exc_info=True)
              return True, self._oidc_error()
  
          # check callback CSRF token passed to IdP
          # against session CSRF token held by user
          if csrf_token != session_csrf_token:
              logger.debug("CSRF token mismatch")
              return True, self._oidc_error()
  
          # make a request to IdP to exchange the auth code for OAuth credentials
          flow = self._flow_for_request()
          credentials = flow.step2_exchange(code)
          id_token = credentials.id_token
          if not self._is_id_token_valid(id_token):
              logger.debug("Invalid ID token")
              if id_token.get('hd') != current_app.config[
                      'OIDC_GOOGLE_APPS_DOMAIN']:
                  return True, self._oidc_error(
                      "You must log in with an account from the {0} domain."
                      .format(current_app.config['OIDC_GOOGLE_APPS_DOMAIN']),
                      self.WRONG_GOOGLE_APPS_DOMAIN)
              return True, self._oidc_error()
  
          # store credentials by subject
          # when Google is the IdP, the subject is their G+ account number
          self.credentials_store[id_token['sub']] = credentials.to_json()
  
          # Retrieve the extra statefield data
          try:
              response = self.extra_data_serializer.loads(state[statefield])
          except BadSignature:
              logger.error('State field was invalid')
              return True, self._oidc_error()
  
          # set a persistent signed cookie containing the ID token
          # and redirect to the final destination
          self._set_cookie_id_token(id_token)
          return False, response
docs: Exchange the auth code for actual credentials,
          then redirect to the originally requested page.