Wow. I just posted a reply but Oculus Forums forced a reauthentication and threw my post away. Sigh. In brief: Second best would be to use OAuth Device Flow. In our case that didn't work since Azure AD B2C doesn't support Device Flow, so I ended up using ROPC instead. Not pretty but it works.