I think we should always encourage people to do such requests from the backend.
Maybe a simple Rails/Sinatra example app where:
-
Discourse users authenticate using SSO with the example application
-
Example application has a simple header that shows DIscourse notifications