Either way, the provider token is validated server-side and encrypted before storage. It is never used as your browser session.