Also you wouldn't need the auth code flow unless you were planning on impersonating the user or use their data in the back channel