Exchanges an authorization code (received from the platform callback) for tokens. Validates the state token against Redis to prevent CSRF. State is one-time-use.
Prefix your API key with "Bearer ". Example: Authorization: Bearer soc_live_...
Platform, code, and metadata (redirect_uri + state)