Skip to main content

Issue an OAuth 2.0 access token

POST 
/oauth2/token

Exchanges an authorization code, refresh token, or client credentials for an access token (and optionally a refresh token and ID token for OpenID Connect clients). The grant_type parameter selects the exchange:

  • authorization_code — exchanges a code received at the authorization endpoint; requires code and redirect_uri, and code_verifier for PKCE clients.
  • refresh_token — exchanges a refresh token for a new access token; requires refresh_token.
  • client_credentials — issues a token for the client itself without end-user involvement; does not require code or refresh_token.
  • urn:ietf:params:oauth:grant-type:jwt-bearer (RFC 7523) — exchanges a JWT assertion for an access token; requires assertion.

Client authentication is performed using one of the configured methods: HTTP Basic (client_id and client_secret in the Authorization header), POST body parameters (client_id + client_secret), or JWT client assertions (client_assertion + client_assertion_type). Refer to the introduction section for details on how to configure this use case.

Request​

Responses​

Token issued successfully

Last updated on