Use OAuth 2.0 Authorization Code exchange flow, but for additional security (since the client is public) use Proof Key for Code Exchange (PKCE) extension
OAuth client (ID) should not be hard-coded, but configured externally (config file, env var, etc)
Ask for at least get_token scope, but possibly additional. Try avoid getting any PII for compliance in cloud environments.
Requirements:
get_tokenscope, but possibly additional. Try avoid getting any PII for compliance in cloud environments.