response_type=token) is not recommended. It can suffer from access token leakage and access token replay attacks. Use response_type=code instead.state parameter for CSRF protection. Pass a sufficient random nonce here and verify this nonce again after retrieving the token.curl --location --request GET 'https://api.soundcloud.com/connect?client_id=some client&redirect_uri=https://soundcloud.com&response_type=code&scope=default'{}