Implement the SoundCloud OAuth 2.1 Authorization Code with PKCE flow, including token exchange and single-use refresh tokens

Verified steps

1. Register an app in SoundCloud's developer settings to get a client ID (and client secret if applicable) — new apps generally require PKCE since OAuth 2.0 without PKCE was phased out
2. Generate a PKCE code_verifier and derive a code_challenge (S256), then redirect the user to SoundCloud's authorize endpoint at secure.soundcloud.com/authorize with response_type=code, your client_id, redirect_uri, and code_challenge
3. After the user authorizes, exchange the returned authorization code (plus the original code_verifier) at the token endpoint (secure.soundcloud.com/oauth/token) for an access_token, refresh_token, and expires_in
4. Store the access_token and refresh_token securely; use the access_token as a Bearer token on subsequent API calls
5. Access tokens expire in roughly one hour — before then (or on a 401), call the token endpoint again with grant_type=refresh_token and the current refresh_token to get a new token pair
6. Immediately discard the old refresh_token after a refresh, since SoundCloud issues single-use refresh tokens and reusing one will fail