You are correct in that you will receive HTML. The user is redirected to give permission to your application based on the scope that you are requesting. If they approve then the link you provided as your redirect link will be called with information and you can pull the token from there. There is no way around this, Twitch has to do two things: 1) verify with the user that they provide explicit permission and 2) verify your application based on a callback URL, especially so no one just hijacks your Client ID and tries to use it to get people to sign up for a service using your ID.
It is possible to not have to authenticate each time, you have to store the token back and retrieve it. Keep in mind that some types of tokens do expire, so Twitch provides a refresh token that may be used to generate a new refresh and access token.
You essentially have to build out another page that will collect that data. Also, the token, of course, only gives you access to the user data that approved the application.