Token endpoint (authorization_code, refresh_token, client_credentials, token-exchange)

POST

/token

• Issuer

Client auth: client_secret_basic/_post, or private_key_jwt (RFC 7523). A DPoP header sender-constrains the issued token (RFC 9449). Also accepts RFC 8693 token exchange (urn:ietf:params:oauth:grant-type:token-exchange) and OID4VCI pre-authorized_code.

Authorizations

• apiKey
• None

Request Body ^required

object

grant_type

required

string

Allowed values: authorization_code refresh_token client_credentials urn:ietf:params:oauth:grant-type:token-exchange urn:ietf:params:oauth:grant-type:pre-authorized_code

code

string

redirect_uri

string

code_verifier

string

refresh_token

string

client_id

string

client_secret

string

client_assertion_type

string

client_assertion

string

scope

string

resource

string

subject_token

RFC 8693 token exchange: the subject access token.

string

subject_token_type

Typically urn:ietf:params:oauth:token-type:access_token.

string

actor_token

Optional RFC 8693 actor token.

string

actor_token_type

string

pre-authorized_code

OID4VCI pre-authorized code from a credential offer.

string

Responses

200

Token response

object

access_token

required

string

token_type

required

string

Allowed values: Bearer DPoP

expires_in

required

integer

scope

string

id_token

string

refresh_token

string

400

OAuth error

object

error

required

string

error_description

string

401

Invalid client

object

error

required

string

error_description

string