External users obtaining tokens through API Management API endpoints?

Hi, my APIs in API Management require both a Bearer token and a subscription key to be passed with each request. I'm looking for a way to automate the process of obtaining tokens without exposing secret client credentials. I'm considering creating a separate API endpoint within API Management that would allow users to obtain their access and refresh tokens by providing a subscription or product key in the request to this endpoint. Is this a secure and valid approach for issuing access and refresh tokens to users?