`POST /oauth/token`

Public. No cookie required.

OAuth 2.1 Token Endpoint (RFC 6749 & RFC 7636)

Exchanges authorization code with PKCE for an access token, or refreshes an expired token.

Body

application/x-www-form-urlencoded

{
  "grant_type": "authorization_code",
  "code": "…",
  "redirect_uri": "…",
  "client_id": "…",
  "code_verifier": "…",
  "refresh_token": "…"
}

Issued access token and refresh token

Generated from @openapi JSDoc. Do not edit by hand — run npm run docs:api.