Authorization flow granting an app scoped API access to a store.
Exchange code → token at /admin/oauth/access_token