Getting access tokens from Postman: Tokens issued for the ‘Single-Page Application’ client-type may only be redeemed via cross-origin requests