The OAuth 2.0 token endpoint.

• authorization_code with PKCE returns an access token and a refresh token for
  the taxpayer that consented, plus grant_id, taxpayer_id, tin and
  taxpayer_name so you can map it to your own records.
• refresh_token rotates the refresh token. Reusing an already-rotated refresh
  token revokes every token of that grant.
• client_credentials returns an organization-level access token (no taxpayer).

Access tokens last one hour. Send them as Authorization: Bearer <token>.