I'm not running a PHP server so that's not an option for me.
After reading a ton of material I understand the 3 Legged Authorization process using OAuth2.
1. Get an Authorization Code
2. Trade the Authorization Code in for an Access Token and a Refresh Token. The Access Token is good for an hour.
3. When the Access Token expires, using the Refresh Token to get a new Access Token. It's the Refresh Token that must be stored for later use in order to get new Access Tokens.
There must be a way to do this with Javascript, jQuery, Ajax, CORS and have offline access.
As you point out PHP, JAVA and other API libraries get it done. So... what are they doing with the request that solves the cross domain problem?