On a server there are two ways to use the client. Pick based on whose permissions the code should have.

Install

Acting as the project

A secret key bypasses your access rules. Keep it in an environment variable and never send it to a browser.

Acting for one user

When your server handles a request from a signed-in user, pass their token so your access rules apply to them exactly as they would in the browser.
With accessToken set, the client keeps no session of its own and does not refresh, so make one per request.

A script that signs in

For a script that runs as a particular user, sign in once; the session stays in memory for the life of the process.

Keys and security

Which key goes where.

Python

The same in Python.