Authenticate to the Getty Images API with the OAuth 2.0 authorization code grant (with PKCE) for user-context requests

Steps

1. Register a client to receive an API key, and choose a client type (public or confidential) based on whether the app can securely store a client secret
2. Generate a PKCE code_verifier and derive a code_challenge from it (Base64url-encoded, hashed with S256 or left as plain), then redirect the user to GET https://authentication.gettyimages.com/oauth2/auth with client_id, response_type=code, redirect_uri, state, code_challenge, and code_challenge_method
3. After the end user signs in with Getty Images/iStock credentials and authorizes, capture the authorization code from the redirect_uri's code query parameter
4. Exchange it for a token with POST https://authentication.gettyimages.com/oauth2/token, sending grant_type=authorization_code, code, redirect_uri, client_id, client_secret (confidential clients only), and code_verifier
5. Store the returned access_token (valid up to 30 minutes) and refresh_token (valid up to one year); refresh with grant_type=refresh_token before the access token expires rather than re-prompting the user