I’m not too fond of the new approach. As a developer integrating your new approach, I don’t want to break the user out of authorizing my app more than once ever.
You have a full-featured app. There is no reason you cannot provide them the ability to deauthorize our app if need be, but no one does this. So now we have an interrupted user experience on mobile devices when a token is needed (even if refresh_token expires.
I really enjoyed the legacy method - it was seamless for the user. Just some feedback, you guys do have a great product - just wish it was as seamless.