OAuth 2.1 token endpoint (code exchange + refresh)
OAuth
OAuth 2.1 token endpoint (code exchange + refresh)
Exchanges an authorization code (+ PKCE code_verifier) for a short-lived opaque access token and a rotating refresh token, or rotates a refresh token. Authorization codes are single-use; refresh tokens are single-use (rotated on every exchange). Public-client posture: no client authentication (token_endpoint_auth_method=none).
POST
OAuth 2.1 token endpoint (code exchange + refresh)
Body
application/x-www-form-urlencoded