交换令牌
POST
/oauth/token
支持 authorization_code 和 refresh_token 两种授权类型。authorization_code 必须传 client_id。refresh_token 场景下 client_id 可选，但如果传了，必须与该刷新令牌绑定的客户端一致。
请求体
application/x-www-form-urlencoded
有效值
"authorization_code""refresh_token"Required for authorization_code. Optional for refresh_token; if provided, it must match the client bound to the refresh token.
格式
"uuid"Required when grant_type=authorization_code.
Required when grant_type=authorization_code. Must exactly match the application's registered redirect URI.
格式
"uri"Required when grant_type=authorization_code.
Required when grant_type=refresh_token.
响应
OAuth tokens
application/json
JSON "access_token": "string", "token_type": "Bearer", "refresh_token": "string", "expires_in": 0
{
}