From 3d858af1fa7bcde3b750e3c9a4cfbf7ab017179a Mon Sep 17 00:00:00 2001
From: Your Name <you@example.com>
Date: Sun, 29 Mar 2026 19:10:13 +1030
Subject: [PATCH] OAuth: Token endpoint response loses required
 no-store/no-cache headers when adding created_at

---
 app/Http/Controllers/OAuth/ApiTokenController.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/app/Http/Controllers/OAuth/ApiTokenController.php b/app/Http/Controllers/OAuth/ApiTokenController.php
index 438740b5b..7d72bace1 100644
--- a/app/Http/Controllers/OAuth/ApiTokenController.php
+++ b/app/Http/Controllers/OAuth/ApiTokenController.php
@@ -24,11 +24,12 @@ class ApiTokenController extends AccessTokenController
 
                 if ($token) {
                     $data['created_at'] = $token->created_at->toIso8601String();
+                    $response->setContent(json_encode($data));
                 }
             }
         }
 
-        return response()->json($data, $response->getStatusCode());
+        return $response;
     }
 
     private function getTokenIdFromJwt(string $jwt): ?string