# description
POST /oauth/token — exchange an authorization code for tokens, or rotate a refresh token. Accepts application/x-www-form-urlencoded (the OAuth norm) or application/json. Which fields are required depends on grant_type.

# properties.code.description
authorization_code grant: the single-use code from the redirect. Expires quickly and is consumed on first use — a replay returns invalid_grant.

# properties.redirect_uri.description
authorization_code grant: must match the redirect_uri used at /oauth/authorize exactly.

# properties.client_id.description
authorization_code grant: required. refresh_token grant: optional, but checked against the token's client when supplied.

# properties.code_verifier.description
authorization_code grant: the PKCE verifier whose S256 hash you sent as code_challenge. Required — there is no non-PKCE path.

# properties.refresh_token.description
refresh_token grant: the token to rotate. Single-use — the old one is revoked and a new one returned alongside the access token.