Exchange a code, or refresh a connection

The OAuth 2.1 token endpoint, for MCP clients a person has connected to their account. grant_type=authorization_code redeems the one-time code the person’s consent sent the client (it works once, for 60 seconds), with the PKCE code_verifier whose S256 challenge came with the authorization request, the same redirect_uri and client_id, and optionally the resource (the MCP address the consent was for). grant_type=refresh_token swaps the current refresh token for a new pair; the old pair stops working at once. A code presented a second time, or a refresh token that has been replaced, ends the connection: one copy of it was stolen. The connection acts as the person, never above the role ceiling they chose or their role of the moment, read-only if they chose that, until the 7, 30 or 90 days they chose; a refresh never extends it. Public clients only: send client_id, and no Authorization header, client_secret or client_assertion (each is refused invalid_client, 401).