Yup, then you take that code and post (step 3) to get an access token (step 4) and then use the access token