Create new access and refresh tokens

The refresh token is returned in the body of the request or as a hardened cookie, depending on configuration. A cookie should be used when the client is running in an insecure environment such as a web browser, and cannot adequately protect the refresh token against unauthorized access.

curl -X POST "https://api.piktid.com/api/tokens"

{
  "access_token": "string",
  "refresh_token": "string",
  "access_expiration": "2019-08-24T14:15:22Z",
  "refresh_expiration": "2019-08-24T14:15:22Z"
}