Implement Smartcar Connect OAuth with correct scopes

Steps

1. From your Smartcar dashboard, set an allowed redirect URI and note your Client ID.
2. Construct the authorization URL: https://connect.smartcar.com/oauth/authorize?response_type=code&client_id={clientId}&redirect_uri={redirectUri}&scope={spaceDelimitedScopes}&state={csrfToken}. Include only the scopes you need, such as read_vehicle_info, read_odometer, read_fuel, read_battery, read_location, read_vin, control_security.
3. Redirect the vehicle owner to the authorization URL; they authenticate with their OEM credentials and grant consent.
4. After consent, Smartcar redirects to your redirect URI with a code parameter; exchange it via POST https://auth.smartcar.com/oauth/token with grant_type=authorization_code, code, redirect_uri, and Base64-encoded Basic Authorization header of clientId:clientSecret.
5. Store the returned access_token (1-hour TTL) and refresh_token (long-lived); use the refresh_token grant to obtain new access tokens.
6. In v3, pass the sc-user-id header on vehicle API requests to scope the application-level token to a specific user.