Supports two grant types:

• authorization_code: exchange an auth code for access + refresh tokens
• refresh_token: obtain a new token pair using a refresh token

Access tokens are valid for 24 hours. Refresh tokens are valid for 30 days.
This endpoint requires no authentication header — credentials are passed in the body.

Public clients (PKCE): Pass code_verifier instead of client_secret when
exchanging an authorization code. For refresh, omit client_secret.