u

docs/api/routes/oauth/token.md

@@ -0,0 +1,30 @@
+# `POST /oauth/token`
+
+Public. No cookie required.
+
+OAuth 2.1 Token Endpoint (RFC 6749 & RFC 7636)
+
+Exchanges authorization code with PKCE for an access token, or refreshes an expired token.
+
+## Body
+
+`application/x-www-form-urlencoded`
+
+```json
+{
+  "grant_type": "authorization_code",
+  "code": "…",
+  "redirect_uri": "…",
+  "client_id": "…",
+  "code_verifier": "…",
+  "refresh_token": "…"
+}
+```
+
+## Response `200`
+
+Issued access token and refresh token
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._