Token endpoint

Confidential clients use their configured client_secret_basic or client_secret_post method. Public clients send client_id and no secret. Mixing methods or sending a secret for a public client returns invalid_client.

• authorization_code consumes a code and verifies its redirect URI and PKCE verifier.
• refresh_token rotates an active token and can narrow its original scope set.
• client_credentials issues an application token for assigned non-OpenID scopes.
• urn:ietf:params:oauth:grant-type:device_code consumes an approved device code.

Validate ID tokens before using claims. Replace a refresh token atomically whenever a response contains a rotated value; reuse of a consumed token revokes its family.

{
  "access_token": "eyJ...",
  "token_type": "Bearer",
  "expires_in": 900,
  "scope": "openid profile",
  "id_token": "eyJ...",
  "refresh_token": "opaque..."
}

• invalid_client: use the registered client and its configured authentication method.
• invalid_grant: start a new flow; the code, verifier, redirect URI, refresh token, or device code is invalid.
• invalid_scope: request only assigned scopes or narrow the original refresh scope.
• unsupported_grant_type: enable and send one of the documented grant identifiers.