I have this curl command

curl -F 'client_id={client id}' \
-F 'client_secret={client secret}' \
-F 'code={temporary token}' \
-F 'grant_type=authorization_code' \
https://cloud.lightspeedapp.com/oauth/access_token.php

taken from

So yeah, turns out Lightspeed just has terrible documentation. Let this be a cautionary tale.