Standard OAuth2 token endpoint for OAuth app credentials. Use grant_type=authorization_code to exchange an authorization code for access and refresh tokens after Request Authorization. Use grant_type=refresh_token on this same endpoint to rotate tokens and keep the connection alive.

OAuth token requests should be sent as application/x-www-form-urlencoded, as specified by OAuth 2.0. JSON requests remain accepted for backwards compatibility.

Do not use this endpoint with Public API credentials issued for server-to-server access. Those credentials must call Create Access Token on /v1/auth/token.

The legacy Refresh token endpoint remains available temporarily for backwards compatibility.

If a refresh fails:

• 401 "Provided secret does not match the client", "client_secret is required for this client" or "The requested token does not belong to the provided client": the client_id/client_secret you sent are wrong (for example another environment's app). Fix them and retry with the same refresh token, which was not consumed.
• 401 "No active OAuth2 client found for provided credentials": the client is unknown, disabled or expired. Check client_id, or register or re-enable the client; retrying with the same credentials will not help. The refresh token was not consumed, but it only works with the client it was issued to.
• Any other 401, and a 403: this refresh token can no longer be used (expired, revoked or already rotated). Discard it and ask the user to reconnect.
• 400: the request is malformed. 5xx: temporary, retry later with the same refresh token.