Sends token-endpoint requests (authorization-code exchange and refresh) with the per-provider options recorded from the Nango catalog in provider metadata (see Tango.Schemas.Provider.catalog_metadata/1).

Without those options the request is the oauth2 library default: client credentials in an HTTP Basic header (plus client_id in the body for the code exchange) and a form-encoded body. The options follow Nango (packages/shared/lib/clients/oauth2.client.ts and packages/server/lib/controllers/oauth.controller.ts):

• "token_request_auth_method" => "basic" - Basic header, and the client credentials also in the body
• "authorization_method" => "header" - client credentials only in the Basic header
• "authorization_method" => "body" - client credentials in the POST body for code exchange and refresh, without Basic authentication unless "token_request_auth_method" => "basic" is also set
• "body_format" => "json" - JSON body instead of a form
• "token_params" - extra params for the code exchange; also used for refresh when there are no "refresh_params"
• "refresh_params" - extra params for the refresh

Extra params never override the grant type, code, redirect URI, PKCE verifier, or refresh token Tango sets.

Responses

Each call posts exactly once. JSON and form-encoded token objects are accepted. In error responses a JSON object body is decoded to a map; any other body stays the raw binary. A code exchange fails with:

• {:error, %OAuth2.Response{}} - a 3xx, 4xx or 5xx status, or a 2xx JSON object carrying an "error" member
• {:error, :empty_access_token} - a 2xx response with an empty body
• {:error, :invalid_token_response} - any other 2xx body that is not a token object (HTML, a JSON scalar, malformed JSON)
• {:error, %OAuth2.Error{}} - a transport failure

A refresh fails with {:error, %OAuth2.Response{}} for a 4xx or 5xx status and for a body that is not a token object, and with {:error, %OAuth2.Error{}} for a transport failure.