Oauth Token
oauth
Oauth Token
OAuth2 Token Endpoint (RFC 6749 §3.2).
Accepts application/x-www-form-urlencoded. Supported grant types:
- authorization_code: requires code, redirect_uri, code_verifier, client_id.
Confidential clients must also present client_secret_basic.
- refresh_token: requires refresh_token, client_id.
Confidential clients must present client_secret_basic.
This is an OAuth2/OIDC standard endpoint — NOT JSON:API.
Errors are plain OAuth JSON ({"error": ..., "error_description": ...}).
SECURITY: rate-limited at the dependency level; client auth is enforced
inside TokenService per §4.3 requirements.
POST
Oauth Token
Authorizations
Send platform JWTs, contact JWTs, or team API keys as Authorization: Bearer <token>.
Query Parameters
Response
Successful Response
Token endpoint success response (RFC 6749 §4.1.4 + OIDC §3.1.3.3).
scope is the space-delimited set of granted scopes (RFC 6749 §5.1). On a
refresh the originally granted scope is carried forward verbatim — never
widened.