sp-api-oauth-demo - authorising application - integrating sp-api-oauth

[paulmanners]

I am able to successfully use python-amazon-sp-api to retrieve Amazon data using a private application on a local machine. I am currently set up as a PRIVATE developer with AWS account etc and have all the credentials - REFRESH_TOKEN, LWA_APP_ID, LWA_CLIENT_SECRET etc...
I would like to turn the private application into a public application and understand that the sp-api-oauth-demo (https://github.com/saleweaver/sp-api-oauth-demo) is an example of how to do this - but I'm not sure how to integrate this.

I understand that the index.html provides a button to authorise access which runs static/script.js which sets up the url to obtain the consent from Amazon. What I don't understand is what happens next. Once consent has been given by the user, how is this used within python-amazon-sp-api? Is the auth_code in the app.py function retrieved from the url and what is 'res' - is this the REFRESH TOKEN?:

@app.route('/redirect')
def redirect_route():
auth_code = request.args.get('spapi_oauth_code')
print(auth_code)
res = AccessTokenClient().authorize_auth_code(auth_code)
print(res)

Does python-amazon-sp-api use 'res' to replace something - REFRESH TOKEN(?). Does anyone have an example of how to integrate sp-api-oauth-demo into an application? I currently store my Amazon credentials in a .env file. I presume I would need to store the 'res' value (REFRESH TOKEN?) and associate it with each user so that this is used when that user signs in - best method?

Do I need to set up a new PUBLIC application (I presume that this OAUTH procedure will not work with a PRIVATE application)? I am currently using python-amazon-sp-api from my local environment - will the oauth procedure work on local?

I know this is a lot of questions - but if anyone can help me with this then I would be most grateful.
Many thanks
Paul