{'status': 401, 'message': 'invalid csrf token'} When trying to authorize through Python Script

You send them to that link. It isn’t a API call. Then they redirect back to you with a code. Then you post with that code to get a token.