Skip to main content
Version: Latest (4.0.6)

Generate Token

POST 
/token-srv/token

This API call is used to generate access token based on the grant type passed. The Flows are described here.

The token endpoint of the cidaas server accepts the following grant types:

Device code : this grant is used when performing authentication on a different device, which is more user-friendly to perform an authentication.

Authorization code : the code obtained from the authorization endpoint which the server uses to look up the granted permission or consent.

Resource owner password credentials : the client obtains the end-user username and password and passes them to the token endpoint; use of this grant should be limited to highly trusted clients or devices.

Client credentials: the client ID and secret obtained from client registration; this grant is intended for clients acting on their own behalf.

Refresh token: a special token which can be used to retrieve a new ID / refresh token.

Token Exchange: retrieve a token with extended scopes by providing a users token in a secured backend

Session transfer: obtain a short-lived opaque Session Transfer Token (STT, typically expires_in 10 seconds) using the native client’s access or refresh token and a target web client_id; pass the STT as stt on the authorization endpoint (see Session transfer).

DPoP (Demonstrating Proof-of-Possession / RFC 9449): send a signed DPoP proof in the DPoP request header to receive a sender-constrained access token bound to the client's public key (cnf.jkt). When DPoP is enabled on the client app, or when using an authorization code or refresh token bound to a DPoP key, this header is mandatory. See the DPoP Guide.

Request​

Responses​

SUCCESS

A successful HTTP response to an access-token request contains a JSON object with the access token and additional data. For DPoP-bound requests, token_type is set to DPoP and the access token contains a cnf.jkt claim.