Exchange an authorization code or a refresh token for tokens

Accepts application/x-www-form-urlencoded and supports the authorization_code and refresh_token grants. The client authenticates with HTTP Basic auth or with client_id/client_secret in the form body. Implements the OpenID Connect token endpoint.

post

Body

application/x-www-form-urlencoded

objectOptional

Responses

200

Access token, and an ID token when the openid scope was requested.

application/json

objectOptional

400

Invalid grant or invalid request.

application/json

401

Invalid client credentials.

application/json

500

Unable to issue token.

application/json

post/api/v1/oauth/token

HTTPcURLJavaScriptPython

POST /api/v1/oauth/token HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: */*
Content-Length: 2

""

{
  "access_token": "hR4pV9mK2sT7dQ1xL0nB",
  "id_token": "eyJhbGciOiJSUzI1NiJ9...",
  "refresh_token": "gY6wC3jN8bF5rZ2tM7vK",
  "token_type": "bearer"
}