Auth code grant type (first steps)