Disregard, I missed the other message. Looking over docs now.
Edit: I see my error and misunderstanding. I’m adjusting, thanks for the guidance.
For future readers, the issue was that I was inadvertently using Implicit Flow as opposed to Authorization Code Flow because I didn’t append response_type=code to my request.