To get a User Token, you would use the Authorization Code flow if it’s a server-side app, or the Implicit Flow for a client-side app (such as API requests being made in the web browser)
For both cases, to get an Access Token from any user they would go to your website, and click a button which redirects them to Twitch, where they can agree to the scopes you’re requesting. Once they accept they’ll be redirected back to your website, at which point the Auth Code flow gives you a code in the querystring param which your server can exchange for an Access Token and Refresh Token, or if using the Implicit flow you’ll get an Access Token in the URL hash.