OAuth 2.1 for apps other people build (ENGIN-52): the token endpoint (codes with PKCE, and rotating refresh tokens), revocation, and the apps a collector has connected. Authorization starts at collection.id/oauth/authorize.
/oauth/grantsSigned inBetaThe apps you’ve allowed to use your account or your stores, and what you allowed each. Settings → Connected apps.
/oauth/grants/{grantId}Signed inBetaThe app loses access at once: every token it holds from this connection stops working. It can ask you again.
/oauth/revokePublicBetaToken revocation (RFC 7009): a refresh token revokes every token from its authorization, an access token itself. Answers 200 whether or not the token existed. Form-encoded, with the app’s client authentication.
/oauth/tokenPublicBetaThe OAuth token endpoint (RFC 6749): a code (with its PKCE verifier) or a refresh token for an access token and the next refresh token. Form-encoded. Confidential apps authenticate with HTTP Basic or client_secret; public apps send client_id. Errors are OAuth’s: { error, error_description }. A used refresh token sent again revokes every token from its authorization.