OAuthTokenRequest

RFC 6749 §4.1.3 / §6 token request. Required fields depend on
grant_type: authorization_code needs code, redirect_uri,
client_id, code_verifier; refresh_token needs only
refresh_token.

{
    "grant_type": "authorization_code",
    "code": "string",
    "redirect_uri": "http://example.com",
    "client_id": "string",
    "code_verifier": "string",
    "refresh_token": "string"
}