I’m using authorization code flow to login UI users and client credentials to login API clients.
AccessToken lifetime should be few minutes for UI users but few hours for API clients.