Authenticate with the Kroger API using OAuth 2.0 client credentials flow and obtain a scoped access token for product and cart operations

Steps

1. Register an application on developer.kroger.com and obtain a client_id and client_secret; note the scopes granted to your app (e.g., product.compact:read, cart.basic:write)
2. Request a client-credentials token by POSTing to the Kroger authorization server's token endpoint with your encoded client credentials and the desired scope in the request body
3. Store the returned access_token and its expiry; cache the token and refresh it before expiry rather than requesting a new one on each call
4. For cart operations that require user context, redirect the user through the OAuth 2.0 authorization code flow; include profile.compact and cart.basic:write in the scope parameter
5. Exchange the authorization code for a user-scoped token, then include it as a Bearer token in the Authorization header on all subsequent cart API requests
6. Implement token refresh logic: when a request returns a 401, re-execute the appropriate flow (client credentials or authorization code refresh) and retry once