Issue an access token (RFC 6749)
POST/oauth/token
Client authentication by HTTP Basic (client_secret_basic) or form fields (client_secret_post), exactly one. grant_type=client_credentials: a 300 s app token (sub = client id; app scopes only, never a user scope). grant_type=authorization_code: redeems a single-use code from the consent screen with PKCE S256 (code_verifier) and the exact redirect_uri; returns a 300 s user token (sub = per-app pairwise subject, never a player id) and a refresh token. grant_type=refresh_token: rotates the refresh token; presenting a used one revokes the whole family and the consent. No Idempotency-Key: the single-use code or refresh token is the replay control (CCR-089 §6).
Request
Responses
- 200
- 400
- 401
- 405
- 503
A token. Cache-Control: no-store.
invalid_request, invalid_grant (unknown, used, expired or mismatched code or refresh token; PKCE failed), invalid_scope or unsupported_grant_type.
invalid_client: client authentication failed.
Fail-closed RFC 9457 Problem Details. No stack traces or credentials.
Response Headers
Server-generated opaque request correlation ID.
Token issuance is not configured, or the platform is switched off.
Response Headers
Server-generated opaque request correlation ID.