seems to suggest that it is required
do I need to implement OAuth Authorization Code flow ... ?
I suppose that your understanding of software development is not correct.
Who requires you to implement that?
As far as I understand you control both sides - client and server. Then it is you who decides what should be done. If you develop software for some customer and this customer gave you the list of requirements, and this includes OAuth2, then it is really required. Or you are developing clients (mobile, SPA) for some existing server application which only supports OAuth2. Then you are really required to implement OAuth2. Otherwise it is not required. It is up to you what authentication mechanism you implement.
What should you do? Take several solutions and compare them from different points of view: Security risks (what are possible attacks, how probable they are, what can be the costs in case of successful attack), the complexity and the costs of implementation of each method, the costs to maintain it, the costs of support, usability, performance, how much money you can actually spend on it, etc. Then you will see what is the optimal solution in your case.
There is no THE best practice. I have to repeat that: it depends on the context, it depends on what are your risks, on what are you requirements to usability, on what price can you pay, etc. This is very naive to look for simple answer.
- In many companies the best practice is to use simple one step login where each application is itself responsible for the authentication. Any login issues are analyzed and resolved much quicker than in case of other solutions.
- In many companies the best practice is to have a separate service for authentication, e.g. based on OAuth or based on JWT.
- In many companies the best practice is to use 2F authentication based on OTP token like RSA SecureID token.
- In many companies the best practice is to use 2F authentication based on authenticator app like MS authenticator or Google authenticator.
- In many companies the best practice is to use 2F authentication based on tokens like YubiKey or Titan.
- In many companies the best practice is to use 2F authentication based on photo TAN.
There is no THE best practice.
One of the very secure methods is using of 2F auth. with RSA SecureID or YubiKey. Are you or your customers ready to buy an RSA SecureID or YubiKey for every user? To pay for corresponding infrastructure? To pay for support (you need a stuff that will support users, answer their questions, analyze their cases, reset their blocked accounts, etc.)
Is it too expensive to you? This is important constraint. Then write that in your question, that your budget is limited with X USD
I mentioned usability. Is it too complex for your users? Do they want to have simpler login process? Then 2F is not for you. But again, write that in your question that usability has very high priority.
Do your users need SSO? If they do, then with OAuth or JWT you have SSO out-of-the box (the amount of code to implement is relatively small), where as with other mechanisms you have to implement much more. So OAuth or JWT can be preferable in such case.
What is your requirement on performance? Depending on your requirements and your infrastructure it can be that OAuth is too slow for your requirements. Test it on your real environment with some realistic load (number of users per second). Then you will see if OAuth fits your performance requirements.