You are using implicit auth, you’ll get better mileage with the “authorization code flow”
As otherwise you need some javascript code to capture the URL fragment and submit that to the server.
With your current solution to extract the token you need to do something like this
But that only presents it to the Webpage, which then has to submit if off. And this token cannot be refreshed as you don’t have the refresh token