Exchange an authorization code, device code, or refresh token for an access token

Confidential clients authenticate per RFC 6749 §3.2. Public clients send client_id with no secret and rely on PKCE or their rotating refresh token. Accepts application/x-www-form-urlencoded or application/json. Send your client_id/client_secret via HTTP Basic (Authorization: Basic base64(client_id:client_secret)) or as body fields. Public clients use token_endpoint_auth_method=none. grant_type=authorization_code requires code, the exact same redirect_uri you sent to /authorize, and code_verifier (the PKCE secret whose SHA-256 hash matches the code_challenge you sent to /authorize). grant_type=refresh_token requires refresh_token and rotates it — store the refresh_token returned in the response and discard the one you presented; it is now rejected if presented again. grant_type=urn:ietf:params:oauth:grant-type:device_code requires device_code and the same A2A resource used at device authorization. Honor authorization_pending and slow_down while the customer completes browser consent.