Client Credential : give 3rd party access to API on behalf of itself (service account)
authrization code:
纯前端，可以无Client_Secret, 用PKCE。但是不管怎么操作，token 要存在前端；这是不安全的。所以，一个相应的后端服务。reference: https://docs.duendesoftware.com/identityserver/v6/bff/overview/
