Exchanges an Okta OIDC ID token for an InCrowd / FanScore access token.

The request is submitted as application/x-www-form-urlencoded. The token field carries the Okta ID token — it is not sent in an Authorization header. The token's signature is verified against Okta's JWKS endpoint, so the endpoint requires no separate authentication of its own.

The token must include the email claim, which means email has to be requested in the scope of the original Okta authorisation call. Display names are taken from the firstName / lastName custom claims where present, falling back to the standard given_name / family_name claims.