OAuth token endpoint
POST/oauth2/token
Standard OAuth 2.0 token endpoint, selected by grant_type. Supports
authorization_code (exchange a browser-login code + PKCE verifier for a
token set) and refresh_token (exchange a refresh token for a fresh set,
rotating the refresh token). Other grant types return
unsupported_grant_type.
Client authentication is HTTP Basic (RFC 6749 §2.3.1): confidential
clients MUST present base64(client_id:secret) (bad/missing → 401 invalid_client); public clients send client_id (Basic or form body)
with no secret and rely on PKCE / rotation.
Request
Responses
- 200
- 400
- 401
A fresh token set, including a new refresh token
invalid_request / invalid_grant / unsupported_grant_type
invalid_client