I think > Endpoint contains the resource server's token endpoint URLs. in https://pkg.go.dev/golang.org/x/oauth2#Config is correctly: > Endpoint contains the authorization server's token endpoint URLs. (Resource servers don't have token endpoint(s), do they?)