OAuth 2.0 authorization code and client credentials flows for user and service-to-service auth.
OAuth 2.0 Flows
# Authorization Code Flow (user-facing apps)
# 1. Redirect to auth server
GET /authorize?response_type=code&client_id=myapp&scope=read
# 2. Exchange code for token
POST /token
{grant_type:authorization_code, code:abc123, client_id:myapp}
# 3. Use access token
Authorization: Bearer eyJhbGci...
# Client Credentials (machine-to-machine)
POST /token
{grant_type:client_credentials, client_id:svc-a, client_secret:secret}
# Refresh token
POST /token
{grant_type:refresh_token, refresh_token:rt-abc}