Retrieve a user's OAuth provider access token from Clerk to call a third-party API on their behalf

Documented steps

1. Ensure the user has connected the provider through Clerk's normal social sign-in or account-connection flow. There is no backend-only way to create the connection.
2. Call GET https://api.clerk.com/v1/users/{user_id}/oauth_access_tokens/{provider} with header 'Authorization: Bearer <CLERK_SECRET_KEY>'.
3. The {provider} segment uses Clerk's prefixed provider id, e.g. oauth_google, oauth_github, oauth_microsoft. Custom providers use custom_<your_provider_key>.
4. SDK equivalent: await clerkClient.users.getUserOauthAccessToken(userId, 'oauth_google'), which returns a paginated list plus totalCount.
5. Read token, external_account_id, scopes and expires_at off each returned OauthAccessToken object.
6. Use the token directly against the provider's API as a bearer credential. Do not persist it long-term; call this endpoint again when you need a current one.
7. Before production, configure your OWN OAuth application credentials for the provider in the Clerk Dashboard. Clerk's preconfigured shared credentials are for development instances only.
8. If you need scopes beyond Clerk's default sign-in scopes (for example Google Calendar or Drive), add them as additional scopes on the provider's Clerk connection so they are requested at authorization time.
9. Docs: https://clerk.com/docs/reference/backend/user/get-user-oauth-access-token