Used by the signin up when a user needs to open a new session in a browser.

Can be used by an application to exchange a refresh token for a new access token before it expires.

Can be used by an application to exchange one access token for another, with different authorization details, and optionally expiration time.

This is used to finish federated authentication flows where the user logs in via an external identity provider (like Google or Microsoft) and the application needs to exchange the authorization code for an identity token to access the user's data. The application should first call federated_auth_request to get the redirect URL and then redirect the user to that URL. After the user logs in and grants access to the application, the identity provider will redirect the user back to the application with an authorization code. The application should then call this endpoint with the authorization code.