To return an authenticated stream, we need to check whether authentication is required (a status code of 401 on an HTTP request means just that). If we've already authenticated, then the request will complete as normal and we can just return the request body. If authentication is required, then we must initiate the process by loading a web browser at the correct URL to ask the user for permission; this is completed by a helper function, openBrowser(), which can be found in this book's source code repository.
When the browser window opens, the user will be told about the permission being requested and, assuming they accept, the page will redirect to a callback URL. We need to set up a simple web server locally to handle this ...
