Hi Naval,

Using a secret, unique key, the client application requests a one-time temporary token from the host application.
This temporary token is returned to the client, which is then combined with the first key. This new, combined token is redirected along with the user to a login screen on the host application.
If this combined token checks out, the user is shown a screen to log in to the host application if they are not logged in.
The user is then prompted by the host application to confirm the connection, usually by clicking a button.
The host application then redirects the user back to the client application, with a new temporary one-time token.
The client application receives the redirected user back, and then combines this new one-time token with another secret unique key, and makes a request back to the host application for the final session token.
This final, authenticated session token is then stored somewhere in the client application, associated with the current user. Every API request that particular user makes is signed with that unique token.

Please follow the below link for more information on this

https://www.newfangled.com/connecting-salesforce-quickbooks-oauth/

Please let me know if this helps

Best Regards
Naga Kiran