In the section "How to get an access token" it states "an access token
will be issued and returned in the response, along with an expiry
timestamp and a refresh token for retrieving a new token once your
access token expires".

What's missing is that the username also is returned in this response.
Above that, it's not clear what exactly the mentioned "timestamp" is.
Before diving into the code, I expected this to be full timestamp to a
date in the future (viz. today + 2 weeks). Turns out the response was
"2 weeks", which makes it more of a "validity period, expressed as a
timestamp"

Additionally this could be expanded with an example, both in case of a
successful response:
{"username":"bramus","refresh_token":"xyz","access_token":"yzx","scope":"re ad","expires_in":
1209599}

as one with an error:
{"detail":"Invalid authorization code or client
credentials.","error":"incorrect_client_credentials"}

Also, it'd be useful to mention the length of the tokens (32
characters), so that developers can craft their databases to it.

Same goes for the section "Refreshing an access token", where a
response would be useful:
{"username":"bramus","access_token":"zyx","refresh_token":"xzy","expires_in ":
1209599}

{"detail":"Invalid authorization code or client
credentials.","error":"incorrect_client_credentials"}

That section also states that an "expiry date" is returned. Would be
better to use the wording as used in "How to get an access token"

Regards,
Bram.