How to properly organize work with VK api?

Question

In contact with

It is desirable on the server side (node.js) to receive a list of communities of any user, and issue it to the application (iframe). At the same time, this is not an application user, just any VK account. The audio.get method requires user token access. This token is given to users of the iframe application, but for the client side. How can I bring this token to the server, or make a bot? And if it is not possible to receive a list of communities from the server, is it normal practice for the application user to receive this list from the client side and send it to the server?