OAuth, how to configure it.

Hi, I am designing a Zendesk support App, and I want to connect my app with Dynamics 365 CRM API using OAuth 2.0.
However, I've check your technical resource https://developer.zendesk.com/documentation/apps/app-developer-guide/using-the-apps-framework/#using-oauth 
But still it's not clear to me totally, my questions are:

1- As I understood, I may configure oauth details in manifest file after I deploy my App, is it correct? 

2- for the time being i succeeded to connect but i used access token generated with Postman so my code it's look like bellow:

function getTaskData(client) {
    var settings = {
        url: 'https://signpostdev.crm4.dynamics.com/api/data/v8.0/contacts',
        headers: { "Authorization": "Bearer eyJ0eXAiOiJKV1Q........},
        type: 'GET',
        dataType: 'json'
    };
    client.request(settings).then(
        function (data) {
            console.log(data);
        },
        function (response) {
            console.log(response);
        }
    );
}

But I realized that my token expired after 2 or 3 hours, so I need to use for connection 3 values TokenURL, ClientID, ClientSecret and use Client Credentials as Grant type.

So that now i am trying to follow-up this turorial https://developer.zendesk.com/documentation/apps/build-an-app/building-a-sell-app-using-oauth-2-0/building-a-sell-app-using-oauth-2-0-part-3-setting-up-oauth-2-0/

2- Is it possible to do my code as bellow in manifist.json and use it before i deploy my app?
and i am not sure if my manifist.json correct or not?

....
 }, 
"oauth": {

        "client_id": "518f.....................",
        "client_secret": "IDo7.....................",
        "authorize_uri": "https://login.microsoftonline.com/xxxxxxxxxx/oauth2/v2.0/authorize",
        "access_token_uri": "https://login.microsoftonline.com/xxxxxxxxx/oauth2/v2.0/token",
        "parameters": [
            {
                "name": "token",
                "type": "oauth"
            }
        ]
    },
    "version": "1.0",
    "frameworkVersion": "2.0"
}

and use this code to call Dynamics API:

var settings = {
  url: 'https://www.example.com/api/user',
  headers: {"Authorization": "Bearer {{setting.token}}"},
  secure: true,
  type: 'GET'
};
var client = ZAFClient.init();

3- Now i think when i write {{setting.token}} it should take what written in my minifist.json correct? is it safely that i put my clientID and clientSecret in manifist.json ??

Thank you in advance..
Samer