Social login and SSO is generally implemented these days as OIDC (which is based on oauth2). You can read the RFCs for it, and they pretty much explain the whole thing.
Oauth2: https://tools.ietf.org/html/rfc6749
PKCE (replaces the implicit flow): https://tools.ietf.org/html/rfc7636