# `POST /oauth/token`

Public. No cookie required.

OAuth 2.1 Token Endpoint (RFC 6749 & RFC 7636)

Exchanges authorization code with PKCE for an access token, or refreshes an expired token.

## Body

`application/x-www-form-urlencoded`

```json
{
  "grant_type": "authorization_code",
  "code": "…",
  "redirect_uri": "…",
  "client_id": "…",
  "code_verifier": "…",
  "refresh_token": "…"
}
```

## Response `200`

Issued access token and refresh token

---

_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._