The token endpoint: the authorization code grant with PKCE, and refresh token rotation with reuse detection.