Refer to the API Authentication doc page, where it says:
explicit grant (is) for server side applications
Also, see What is the difference between the 2 workflows? and related questions.
Basically, unless you have your own web server (and usually your own domain), use the implicit flow. The implicit flow merely requires either a web browser or a program that can act like one -- which your Java program can be made to do.
The explicit flow can nominally be made more secure, but it is not as easy to implement and requires both a client program and a web application to be developed (and hosted) by you.
- Use the "implicit OAuth 2.0 flow" (Client side). Activate
Enable Client Side OAuth Flow in your app's control panel.
Disable Desktop Application OAuth Redirect Uri unchecked.
OAuth Domain to
- Be sure to use
GET requests for implicit (client side) OAuth and
POST for explicit (server-side) OAuth.
When the authentication is successful, the
access_token will be in the
location.hash of the redirected page. For example: