Thanks for reaching out about this, and good question.
To clarify, the authorization code that is the first part of our OAuth flow is a manual process that requires the user to authorize your OAuth app via the browser. This is a one time authorization, and can’t be done programmatically.
Once you have the authorization code, you can programmatically retrieve an access token and subsequent refresh tokens.