Token endpoint. Supports the authorization_code and refresh_token grant types, sent as application/x-www-form-urlencoded. The client_credentials grant is available only to Wingspan-provisioned machine clients that authenticate with private_key_jwt; clients registered through the API cannot use it. The client authenticates with the method it registered (client_secret_basic, client_secret_post, private_key_jwt or none). Errors are returned as OAuth error objects (400, 401 for invalid_client). The response is not cacheable.