Implement Bynder OAuth2 authentication for both a user-facing integration (authorization code) and a backend batch job (client credentials), including long-lived offline access

Steps

1. Register an OAuth2 app in the Bynder portal to obtain a client ID and client secret scoped to the account's OAuth server (matching the account's domain, e.g. `.com` vs regional)
2. For user-facing flows, redirect the user to Bynder's authorization endpoint, capture the returned authorization code, and exchange it at the token endpoint for an access token
3. Request the `offline` scope during the authorization code flow if you need a refresh token, since access tokens otherwise expire (on the order of one hour) with no way to silently renew them
4. For backend-only/server-to-server jobs, use the client credentials grant against the token endpoint to obtain an access token without any user interaction
5. As an alternative to full OAuth2 for simple server integrations, generate a permanent token from account settings for direct API access without implementing token refresh logic
6. Store refresh tokens and permanent tokens with the same care as secrets, and implement refresh-token rotation for the authorization code flow before access tokens expire