Get an OAuth 2.0 access token for the Shutterstock API using the authorization code grant and refresh it before it expires

Steps

1. Create a Shutterstock application at shutterstock.com/account/developers/apps to obtain a consumer key (client_id) and consumer secret (client_secret)
2. Redirect the user to GET https://api.shutterstock.com/v2/oauth/authorize with client_id, redirect_uri, response_type=code, a space-separated scope list (e.g. 'licenses.create licenses.view purchases.view'), and a state value
3. After the user logs in and approves, capture the authorization code from the redirect_uri's code query parameter (valid once, expires after 5 minutes)
4. Exchange the code for a token with POST https://api.shutterstock.com/v2/oauth/access_token using grant_type=authorization_code, client_id, client_secret, redirect_uri, code, and expires=true or expires=false
5. If expires=true was used, store the returned refresh_token (prefixed '3/') and refresh the access_token before its 1-hour expiry via POST /v2/oauth/access_token with grant_type=refresh_token, refresh_token, client_id, and either client_secret or user_id
6. Pass the resulting access_token as 'Authorization: Bearer <token>' on subsequent API calls