The token endpoint returns WP REST's error shape, `{code, message, data}`, not RFC 6749 §5.2's `{error, error_description}`, which is what real OAuth2 client libraries parse. This is a breaking response change, so it needs its own release.
The PKCE work in #1 already tags its `WP_Error`s with `data['error']` (e.g. `invalid_grant`), so the mapping from existing error codes to RFC error codes is mostly mechanical once this lands.
The token endpoint returns WP REST's error shape, `{code, message, data}`, not RFC 6749 §5.2's `{error, error_description}`, which is what real OAuth2 client libraries parse. This is a breaking response change, so it needs its own release.
The PKCE work in #1 already tags its `WP_Error`s with `data['error']` (e.g. `invalid_grant`), so the mapping from existing error codes to RFC error codes is mostly mechanical once this lands.