Authorization-code response
A normal integration can receive access_token, refresh_token, token_type (Bearer), expires_in, session_id, and safe user information. Core/system clients can use different recovery behavior, so do not generalize their responses.
Access tokens
Use an access token as Authorization: Bearer <access_token> when calling /oauth/userinfo. Access tokens are short-lived. Validate issuer, audience, signature, token type, and expiry when your backend accepts one; the public key set is at /.well-known/jwks.json. For current session status, a confidential backend can use introspection.
Refresh and session identifiers
session_id identifies a Bhauu-side session in the token response. It is not an ID token. Refresh/session recovery varies by integration. A generic public refresh-grant tutorial is not part of this stable documentation contract yet; do not build continuity assumptions from an example response alone.