If the authentication is complete, and redirect_to is defined, the Service will redirect the user to your webpage, or to your back endpoint, so you can continue with your workflow, with the authenticated request token.

So I need to use deep linking in my app right?

I'm not sure about the /authenticate endpoint, but for the /auth/access endpoint of the api the redirect_to, is optional. But in case you want to be sure that your user has approved your request, you have to keep track of it with your own endpoint, I guess the service is sending back the request token that got approved, so you will know for which user your link has been triggered. If not, you can add on your url a parameter, with information on it, so you will know for which user has been triggered,