OK. Sounds good. Client has given me an account on their store, but I'm not able to install the app (not the Store Owner). So asked the client to do so, explained which scopes to request (just the two default read scopes, and not the Storefront API at all), and they've done that.
It seems that to get an access token, I need to create a new private app. But I thought that installing Shopify's own GraphQL app would be the neater alternative. Do I still need to create a new private app (which means going back to the client as Store Owner and asking them to go through this process)?
Alternatively is there any way to go through the OAuth process using Shopify's GraphQL app?
I feel like I'm missing something pretty basic, and the documentation is taking me in circles.