Deprecated compatibility endpoint. Prefer the OAuth2 token endpoint with grant_type=refresh_token.

OAuth token requests should be sent as application/x-www-form-urlencoded, as specified by OAuth 2.0. JSON requests remain accepted for backwards compatibility.

Request new access and refresh tokens. Upon requesting new tokens, both old access_token and refresh_token values will be invalidated - make sure you update the refresh_token in your database every time you call this endpoint.
New refresh tokens should be requested at least once every 30 days (daily or weekly is fine) in order to keep the connection alive.

If a refresh fails:

• 401 "Provided secret does not match the client", "client_secret is required for this client" or "The requested token does not belong to the provided client": the client_id/client_secret you sent are wrong (for example another environment's app). Fix them and retry with the same refresh token, which was not consumed.
• 401 "No active OAuth2 client found for provided credentials": the client is unknown, disabled or expired. Check client_id, or register or re-enable the client; retrying with the same credentials will not help. The refresh token was not consumed, but it only works with the client it was issued to.
• Any other 401, and a 403: this refresh token can no longer be used (expired, revoked or already rotated). Discard it and ask the user to reconnect.
• 400: the request is malformed. 5xx: temporary, retry later with the same refresh token.