How can i safely pass access token generated from Google OAuth to a NodeJS REST API?

I am creating two application :
1. Chrome extension for gmail.
2. It’s IOS version

Now, since both the applications have same behavior and uses same google apis extensively, i decided to create a single project in google cloud platform for both. Now, when creating credentials, what will be my application type? I see both ‘IOS‘ and ‘Chrome App‘ under application type. Should i generate two Client IDs for chrome app and ios app?

To use single Client ID, i also tried creating a Node REST API (created a new project and set application type to ‘web application‘ in google cloud platform) that will be used by both of my application to make request to google apis? But the authorization process includes, setting a callback url to get the authorization code and later use this code to get the access token. I guess this is not feasible for a REST API. Where should i keep the authorization part? In the application itself and later send the access token to my rest api? Is it possible?

I am very much confused about how should i start. Please could anyone suggest a better way to do this?