Proper OAuth2 authentication flow for a web API using the EWS Managed API
<p>I've been reading through a bunch of documentation for using OAuth with Azure AD, but am still completely confused about how to properly implement things for my situation.  Hopefully someone can steer me in the right direction.</p>

<p>I have created an ASP.NET Web API application that uses the EWS Managed API to access Exchange on behalf of different users.  My application exposes endpoints such as <code>/Mailbox/Messages</code> and <code>/Appointments</code> with the intent that some front end web application will eventually use them to retrieve a user's emails and appointments.  Currently the endpoints are working using basic http authentication, but I'd like to update them to use OAuth.  The application has been registered in my Azure AD instance and I've configured it to require the "Access mailboxes as the signed-in user via Exchange Web Services" API permission.</p>

<p>Since the front end hasn't been implemented yet, I've been trying to test by manually calling the authentication endpoint.  This prompts me to log in and provide consent.  If I consent, I'm redirected to the callback URL that I provided when I registered the app with the authorization code contained in the query parameters.  I'm still not quite sure how I'm supposed to be using this callback, but for the sake of testing I currently have the callback redeem the authorization code for an access token.  This is done by calling the <code>AcquireTokenByAuthorizationCode</code> method on an instance of the <code>AuthenticationContext</code> class and providing my application's id and secret.  Again, just for the sake of testing I return the access token to the browser.  I can then call my aforementioned endpoints (after some modifications) with this access token and get the emails for the user.  I'm guessing much of this is not the correct way to be doing things.</p>

<p>Some of my points of confusion:</p>

<ol>
<li>What should the callback that I registered in Azure AD actually be doing when it gets the authorization code?  Is this intended for a different type of application?  Perhaps one that isn't just playing the role of a middle man.</li>
<li>I'm trying to make my application somewhat RESTful, so I don't want to have to maintain the access tokens on my end between requests.  As such, does it make sense for my endpoints to expect that the access token be provided in the authentication header for each request?  If so, does that mean the front end application should be responsible acquiring the access token and passing it to me?</li>
</ol>

<p>Being completely new to OAuth and Azure, I'm not sure if any other details are pertinent, but I can provide more information as needed.</p>