diff --git a/.gitignore b/.gitignore
index ab1e82a..21695de 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,3 @@
 config.json
 .DS_Store
+token.json
diff --git a/auth/auth.go b/auth/auth.go
index bce99dd..0f4e374 100644
--- a/auth/auth.go
+++ b/auth/auth.go
@@ -10,6 +10,8 @@ import (
 	"golang.org/x/oauth2"
 )
 
+var tokenStore TokenStore
+
 func generateState() (string, error) {
 	b := make([]byte, 32)
 	if _, err := rand.Read(b); err != nil {
diff --git a/auth/oauth.go b/auth/oauth.go
index 06a0fb5..57aed54 100644
--- a/auth/oauth.go
+++ b/auth/oauth.go
@@ -28,4 +28,5 @@ func CreateTestOAuth() {
 		},
 	}
 	OAuthConfigs = append(OAuthConfigs, oauthConfig)
+	tokenStore = TokenStore{filePath: "token.json"}
 }
diff --git a/auth/oauth_callback.go b/auth/oauth_callback.go
index 106a02e..479da97 100644
--- a/auth/oauth_callback.go
+++ b/auth/oauth_callback.go
@@ -1,8 +1,11 @@
 package auth
 
 import (
-	"fmt"
+	"context"
+	"log"
 	"net/http"
+
+	"golang.org/x/oauth2"
 )
 
 // this is usually served at /callback
@@ -27,5 +30,24 @@ func OAuthCallback(w http.ResponseWriter, r *http.Request) {
 		MaxAge: -1,
 	})
 
-	fmt.Printf("Handling some OAuth, %s\n", code)
+	verifierCookie, err := r.Cookie("pkce_verifier")
+	if err != nil {
+		http.Error(w, "Missing PKCE verifier", http.StatusBadRequest)
+		return
+	}
+
+	verifier := verifierCookie.Value
+
+	token, err := OAuthConfigs[0].Exchange(context.Background(), code, oauth2.VerifierOption(verifier))
+	if err != nil {
+		http.Error(w, "Failed to exchange token: "+err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	// Store the token securely
+	if err := tokenStore.Save(token); err != nil {
+		log.Printf("Failed to save token: %v", err)
+	}
+
+	http.Redirect(w, r, "/user", http.StatusTemporaryRedirect)
 }