OAuth 2.1 token endpoint
POST /oauth/token
Exchanges an authorization code (with PKCE verifier) or a refresh token for a new access token (and rotated refresh token). Body MUST be application/x-www-form-urlencoded per RFC 6749. Response carries Cache-Control: no-store. Confidential clients authenticate by passing client_secret in the body; public clients omit it. Refresh token reuse triggers family-wide revocation of all access + refresh tokens issued from the original grant.
Request Body
Section titled “Request Body ”object
OAuth 2.1 grant type. Supported: authorization_code, refresh_token.
Example
authorization_codeAuthorization code (required for grant_type=authorization_code).
Must exact-match the redirect_uri originally used to obtain the code.
OAuth client identifier issued by the registration endpoint.
Required for confidential clients; MUST be omitted for public clients.
PKCE verifier (S256). Required for grant_type=authorization_code.
Refresh token (required for grant_type=refresh_token).
Optional space-separated scope list. For grant_type=refresh_token, MUST be a subset of the original refresh token’s scopes (scope downgrade only). Upgrade is rejected with invalid_scope.
Responses
Section titled “ Responses ”Access token issued
object
RFC 6749 §5.2 error envelope (invalid_request, invalid_grant, invalid_client, unsupported_grant_type)
object
Client authentication failed (invalid_client)