How to properly authorize a user (vk) in an iframe application?

Question

In contact with

Good afternoon.
When there was a separate site (a game created for self-learning), authorization was done through passport.js on the server side (user data was stored in the site session). Now I decided to make an iframe application, but I can't figure out how to organize authorization correctly.
Now I did this (I guess it's not right): after starting the game, I call something like

VK.api('users.get', {'fields': ['photo']}, function(data) {
  user = data.response[0]
  if (user.id !== undefined) {
    let ioGame = io.connect(HOST); // io - socket.io
    ioGame.on('connect', function() {
      let profile = {
        id: user.id,
        provider: 'vkontakte',
        displayName: user.first_name + ' ' + user.last_name,
        photo: user.photo
      };
      ioGame.emit('init', profile);
    });
  }
})

Answer 1

https://vk.com/dev/access_token