Obtain a five-minute scoped token from your application server. Never paste application secrets in the browser.