O Auth Token

Exchange an OAuth authorisation code, device code, refresh token, or client credentials grant for tokens. Supported grants are advertised by `/.well-known/openid-configuration`. Public clients authenticate with `client_id` only and must use grants suitable for public clients, such as device code or authorisation code with PKCE. Confidential clients must provide `client_secret` for authorisation-code, refresh-token, and client-credentials exchanges. Storyden access tokens are short-lived JWTs containing the issued `scope`. Revoking a refresh token or changing account permissions does not revoke an already-issued access token; permission changes are applied on the next token issuance or refresh. Device-code polling returns OAuth-compatible errors such as `authorization_pending`, `slow_down`, `expired_token`, `access_denied`, and `invalid_grant`.

curl -X POST "https://loading/api/oauth/token" \  -H "Content-Type: application/x-www-form-urlencoded" \  -d 'grant_type=string&client_id=string'

{
  "access_token": "string",
  "token_type": "string",
  "expires_in": 0,
  "scope": "string",
  "id_token": "string",
  "refresh_token": "string",
  "error": "string"
}

{
  "error": "string",
  "error_description": "string"
}

{
  "error": "string",
  "message": "string",
  "suggested": "string",
  "metadata": {}
}