Migrate OAuth 1.0a user tokens to OAuth 2.0 with token exchange

The X API now lets you move existing OAuth 1.0a users to OAuth 2.0 without asking them to authorize your app again.

Exchange each user's stored access token and secret at POST /2/oauth2/token using grant_type=urn:ietf:params:oauth:grant-type:token-exchange. You'll get an OAuth 2.0 access token and refresh token.

The new scopes come from the permissions the user originally granted, with offline.access always included. X's migration guide covers the request format, permission mapping, rate limits, and errors.