Hard to believe this isn't common practice at this point. Way back when I was just getting started in my career I implemented an OAuth 2.0 server and it was already accepted that auth code grants were the only reasonable way to do things. Here's what I wrote in the docs for that project:
The decisions that are most important to the security of your application are:
- The authorization endpoint will only return authorization codes, which can later be exchanged for access tokens.
- Password credentials grants, implicit grants, client credentials grants, and all extension grants are not supported.
- Public clients are not supported.
- Every client is required to register its redirect_uri.
- All authorization, token, and API requests are required to use TLS encryption in order to prevent credentials from being leaked to a third-party. In addition, the registered redirect_uri must also be secured with TLS.
- Clients are required to CSRF-protect their redirection endpoints.