Exchange client credentials for an access token

The way an integration authenticates. Send the app's client_id and client_secret and get back a bearer token to put in Authorization on every other call.

This endpoint is different from the rest of the API in three ways, and all three matter:

1. It takes no token — it is the one that gives you one. It is also the only endpoint with no authentication at all.
2. It accepts application/x-www-form-urlencoded, which is what OAuth 2 says and what a generic OAuth client sends. JSON works too.
3. Its errors are OAuth 2 errors — {error, error_description} with a 400 or a 401 — and not the {code, message, data} of everywhere else. This is the single exception in the whole API, and it exists so a generic OAuth client understands the answer.

Credentials travel either in the body (client_secret_post) or in Authorization: Basic base64(client_id:client_secret) (client_secret_basic). Both are standard and both are accepted.

Cache the token until it expires. The endpoint is rate limited per client_id and IP — 30 attempts a minute, and 10 failures in five minutes — so asking for a fresh token on every call will eventually get a 429 with a Retry-After. A correct integration asks once and refreshes shortly before expires_in.

What comes back is an access token and nothing else: no refresh token and no id token. When it expires, ask again.