Token Endpoint

OAuth 2.1 token endpoint.

Supports two grant types:

1. authorization_code: Exchange code for access + refresh tokens
2. refresh_token: Rotate tokens

Request Body: grant_type: "authorization_code" or "refresh_token"

For authorization_code:
    code: Authorization code from /authorize
    code_verifier: PKCE code verifier
    client_id: OAuth client ID
    redirect_uri: Must match original request
    resource: Optional MCP server URL (RFC 9728 B2-5)

For refresh_token:
    refresh_token: Refresh token from previous /token response
    client_id: OAuth client ID

Returns: access_token: JWT signed with RS256 refresh_token: Opaque token (only for authorization_code grant) token_type: "Bearer" expires_in: Expiration in seconds scope: Space-separated scopes

Security Notes: - PKCE required for authorization_code grant - Refresh token rotation (old token revoked) - Rate limited per client - All tokens stored encrypted in database

Example Response: { "access_token": "eyJhbGc...", "refresh_token": "abc123...", "token_type": "Bearer", "expires_in": 3600, "scope": "focused.read focused.write" }

Example Error: { "error": "invalid_grant", "error_description": "Authorization code expired" }