If after reading the documentation you decide that you will use the
web application flow, then yes, you will need to point the redirect URL to a valid URL on your site that will exchange the authorization code for an access token as documented
here. If you request
offline access then you will only need to do this once per account, after which you can use the refresh token to get new access tokens without further intervention by the user.