For client-side requests you’ll use the Implicit auth flow, which means you need to actually send the user of your app there and if they approve your app they will be redirected back with an access token.
Once you have that access token you can make requests until that token expires, after which point you’ll need to send the user through the auth flow again.