type: object
description: |
    RFC 6749 §5.1 token-response payload. Returned by `POST /oauth/token`
    on a successful `authorization_code` or `refresh_token` grant.
required: [access_token, token_type]
properties:
    access_token:
        type: string
        description: Signed JWT — the bearer token to use against the API.
    token_type:
        type: string
        description: Always `Bearer` for this server.
        example: Bearer
    expires_in:
        type: integer
        description: Lifetime of `access_token` in seconds from issue.
    refresh_token:
        type: string
        description: |
            Refresh token. Returned on the `authorization_code` grant and,
            depending on policy, on `refresh_token` grants too.
    scope:
        type: string
        description: Space-separated scopes granted on this token.
    id_token:
        type: string
        description: Optional OIDC id-token JWT.
example:
    access_token: "eyJhbGciOiJSUzI1NiIsImtpZCI6ImtleS0xIn0…"
    token_type: Bearer
    expires_in: 3600
    refresh_token: "rt_01HZW1234567890ABCDEF"
    scope: "profile entitlements"
