The token endpoint is the OAuth server endpoint where a client exchanges an authorization code, and sometimes client credentials or a PKCE verifier, for tokens. Those tokens may include access tokens, refresh tokens, and sometimes ID tokens.
It matters because this is the point where login data becomes usable credentials. If a client sends the exchange to the wrong endpoint, an attacker can capture the authorization code, client secret, or proof key and use them to impersonate the application or complete the login flow. This is why defenders treat endpoint selection as a trust boundary, not a routine network call. Secure implementations validate the issuer, require strict redirect handling, and only send sensitive OAuth material to the expected token endpoint. In attacks, abuse often comes from discovery manipulation, redirect confusion, or endpoint substitution rather than from breaking encryption itself.