We use oauth.io as a hosted service to handle to interchange. I've been using them for years and believe them to be trustworthy.

It probably makes sense to switch off them in due time (since it's just one more dependency). But it allowed us to launch fast.

I'll create a github issue to track this.