Function oauth_token 

pub(crate) async fn oauth_token(
    __arg0: State<AppState>,
    peer: Peer,
    headers: HeaderMap,
    __arg3: Form<OAuthTokenForm>,
) -> Response

POST /oauth/token

authorization_code exchange and refresh_token rotation, both DPoP bound. Every exchange and every refresh runs through crate::oauth::dpop_seam::DpopVerifier, which crate::oauth::OAuthState::default wires to the real RFC 9449 verifier — see crate::oauth::dpop. The proof is checked before the client or the grant; see checked_proof.

A confidential client authenticates each one with a client assertion, checked by authenticated_client before either grant runs.

Both are judged by policy before a token is issued; see crate::oauth::token::GateAdmission.