Exchanges an authorization code or refresh token for an access token
Send the body as application/x-www-form-urlencoded, not JSON. Light forwards the six fields to its identity provider unchanged and returns its answer, so a rejected grant comes back with the provider's own status and body ({"error": "invalid_grant", "error_description": "..."}), not the {name, type, errors[]} envelope used elsewhere. Response keys are snake_case (access_token, expires_in in seconds, token_type, refresh_token), and refresh_token is null when the grant didn't produce one.
Authorization
Send one of these on every request. See
Authentication for how to get credentials.
API key
Basic authentication header of the form Basic<api_key>, where <api_key> is your api key.