Generate Token

POST 
/token-srv/token

This API call is used to generate access token based on the grant type passed. The Flows are described here.

The following grant types are supported:

Device code : this grant is used when performing authentication on a different device, which is more user-friendly to perform an authentication.

Authorization code : the code obtained from the authorization endpoint which the server uses to look up the granted permission or consent.

Resource owner password credentials : the client obtains the end-user username and password and passes them to the token endpoint; use of this grant should be limited to highly trusted clients or devices.

Client credentials: the client ID and secret obtained from client registration; this grant is intended for clients acting on their own behalf.

Refresh token: a special token which can be used to retrieve a new ID / refresh token.

Token Exchange: retrieve a token with extended scopes by providing a users token in a secured backend

Session transfer: obtain a short-lived opaque Session Transfer Token (STT, typically expires_in 10 seconds) using the native client’s access or refresh token and a target web client_id; pass the STT as stt on the authorization endpoint (see Session transfer).

DPoP (Demonstrating Proof-of-Possession / RFC 9449): send a signed DPoP proof in the DPoP request header to receive a sender-constrained access token bound to the client's public key (cnf.jkt). When DPoP is enabled on the client app, or when using an authorization code or refresh token bound to a DPoP key, this header is mandatory. See the DPoP Guide.

Request

Responses

200

SUCCESS

A successful HTTP response to an access-token request contains a JSON object with the access token and additional data. For DPoP-bound requests, token_type is set to DPoP and the access token contains a cnf.jkt claim.

400

BAD REQUEST