How can I get an offline access token for my custom app to store securely for further use?

The shop can be obtained from the session:

app.post("/api/install", async (_req, res) => {
  console.log(res.locals.shopify.session.shop);
});

The app template comes with REST and GraphQL clients, so you don’t need to manually construct the requests with Axios. Here’s an example of creating a script tag with the REST client:

app.post("/api/install", async (_req, res) => {
  const client = new shopify.api.clients.Rest({session: res.locals.shopify.session});

  await client.post({
    path: "script_tags",
    data: {"script_tag":{"event":"onload","src":"https://some-example.com/script.js"}},
  });

  ... 

});