These API requests should usually be made in the backend service. This is just to show the process and the principle on the front end.
The client needs to use the provided authorization_code to get a valid token
Authorization Code:
Token:
Refresh Token:
If the client has a valid access token, client will be able to access protected resources
Success?
If client has a valid refresh token, send it up to get a new token