After removing unauthenticated calls to the Web API I have problem with getting a token. I have found on developer.spotify that I need make an authorization code flow. The biggest problem is:
It provides an access token that can be refreshed. Since the token exchange involves sending your secret key, this should happen on a secure location, like a backend service, not from a client like a browser or mobile apps.
Is there some another ways to use web api like "get track" or "search an item" without an authorization code flow?