I haven't used this so I'm not sure what's going on, but I believe OAuth involves a redirect back to servers controlled by the third party to actually do something with the authentication token. This doesn't strike me as necessarily fishy.
Hi bdittmer, we don't store any of your content, nor any of your passwords. We only store meta data that describes the organization of your documents and do so server-side so that we can add features in an upcoming release that we otherwise wouldn't be unable to add.