docs(auth): auth steps for client applications

get a confirmation code
exchange to the access_token

time: 1h:20