Complete an OAuth sign-in (SPA flow) → token + refreshToken + user

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.

Download OpenAPI JSON