client_id=xyz&code_challenge=foo&code_challenge_method=S256&scope=authenticate_user+openid

{"error": "invalid_request", "error_description": "The request is missing a required parameter"}

if code := r.StatusCode; code < 200 || code > 299 {
	return nil, &RetrieveError{
		Response: r,
		Body:     body,
	}
}

switch content {
case "application/x-www-form-urlencoded", "text/plain":
	// some endpoints return a query string
	vals, err := url.ParseQuery(string(body))
	if err != nil {
		if failureStatus {
			return nil, retrieveError
		}
		return nil, fmt.Errorf("oauth2: cannot parse response: %v", err)
	}
	retrieveError.ErrorCode = vals.Get("error")
	retrieveError.ErrorDescription = vals.Get("error_description")
	retrieveError.ErrorURI = vals.Get("error_uri")
	token = &Token{
		AccessToken:  vals.Get("access_token"),
		TokenType:    vals.Get("token_type"),
		RefreshToken: vals.Get("refresh_token"),
		Raw:          vals,
	}
	e := vals.Get("expires_in")
	expires, _ := strconv.Atoi(e)
	if expires != 0 {
		token.Expiry = time.Now().Add(time.Duration(expires) * time.Second)
	}
default:
	var tj tokenJSON
	if err = json.Unmarshal(body, &tj); err != nil {
		if failureStatus {
			return nil, retrieveError
		}
		return nil, fmt.Errorf("oauth2: cannot parse json: %v", err)
	}
	retrieveError.ErrorCode = tj.ErrorCode
	retrieveError.ErrorDescription = tj.ErrorDescription
	retrieveError.ErrorURI = tj.ErrorURI
	token = &Token{
		AccessToken:  tj.AccessToken,
		TokenType:    tj.TokenType,
		RefreshToken: tj.RefreshToken,
		Expiry:       tj.expiry(),
		ExpiresIn:    int64(tj.ExpiresIn),
		Raw:          make(map[string]any),
	}
	json.Unmarshal(body, &token.Raw) // no error checks for optional fields
}