Use this endpoint to authenticate a user with an identity provider. It will return a 302 redirect to the external identity provider specified in identity_provider.

Get an Access Token in order to call an API. Optionally, you can also retrieve an ID Token and a Refresh Token. Refresh your Access Token using a Refresh Token you got during authorization.

Supported Grant Types:

• Password
• Refresh Token
• Authorization Code
• Authorization Code and Verifier
• Client Credentials
• Device Code
• One-Time Password (OTP)
• Token Exchange

Usage:

• Get token with password:
  • client_id required
  • grant_type=password required
  • username required
  • password required
  • scope
    For example:

      POST /token HTTP/1.1
      Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
      Content-Type: application/x-www-form-urlencoded
    
      client_id=YOUR_CLIENT_ID&grant_type=password&username=YOUR_USERNAME&password=YOUR_PASSWORD
    

• Get token with refresh token:
  • client_id required
  • grant_type=refresh_token required
  • refresh_token required
  • scope
    For example:

      POST /token HTTP/1.1
      Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
      Content-Type: application/x-www-form-urlencoded
    
      client_id=YOUR_CLIENT_ID&grant_type=refresh_token&refresh_token=YOUR_REFRESH_TOKEN
    

• Get token with authorization code:
  • client_id required
  • grant_type=authorization_code required
  • code required
  • redirect_uri
    For example:

      POST /token HTTP/1.1
      Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
      Content-Type: application/x-www-form-urlencoded
    
      client_id=YOUR_CLIENT_ID&grant_type=authorization_code&code=YOUR_AUTHORIZATION_CODE
    

• Get token with authorization code verifier:
  • client_id required
  • grant_type=authorization_code_verifier required
  • code required
  • code_verifier required
  • redirect_uri
    For example:

      POST /token HTTP/1.1
      Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
      Content-Type: application/x-www-form-urlencoded
    
      client_id=YOUR_CLIENT_ID&grant_type=authorization_code&code=YOUR_AUTHORIZATION_CODE&code_verifier=YOUR_CODE_VERIFIER
    

• Get token with client credentials:
  • client_id required
  • grant_type=client_credentials required
  • scope
    For example:

      POST /token HTTP/1.1
      Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
      Content-Type: application/x-www-form-urlencoded
    
      client_id=YOUR_CLIENT_ID&grant_type=client_credentials
    

• Get token with device code:
  • client_id required
  • grant_type=device_code required
  • device_code required
    For example:

      POST /token HTTP/1.1
      Content-Type: application/x-www-form-urlencoded
    
      client_id=YOUR_CLIENT_ID&grant_type=device_code&device_code=YOUR_DEVICE_CODE
    

• Get token with one-time password:
  • client_id required
  • grant_type=otp required
  • username required
  • otp required
  • scope
    For example:

      POST /token HTTP/1.1
      Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
      Content-Type: application/x-www-form-urlencoded
    
      client_id=YOUR_CLIENT_ID&grant_type=otp&username=YOUR_EMAIL_OR_PHONE&otp=YOUR_OTP_CODE
    

• Get token with token exchange:
  • client_id required
  • grant_type=token_exchange required
  • subject_token_type required
  • subject_token required
  • scope
    For example:

      POST /token HTTP/1.1
      Content-Type: application/x-www-form-urlencoded
    
      client_id=YOUR_CLIENT_ID&grant_type=token_exchange&subject_token_type=YOUR_SUBJECT_TOKEN_ISSUER&subject_token=YOUR_SUBJECT_TOKEN
    

Use this endpoint to invalidate a Refresh Token if it has been compromised.

The introspection endpoint is an OAuth 2.0 endpoint that takes a parameter representing an OAuth 2.0 token and returns a JSON.

The protected resource is using a separate OAuth 2.0 bearer token to authorize or a client identifier and client secret to authenticate itself to the introspection endpoint.

Usage:

The protected resource calls the introspection endpoint using an HTTP POST request with parameters sent as application/x-www-form-urlencoded data.

• Get token info with client identifier and client secret:

  • token required
  • token_type_hint
    For example:

      POST /tokeninfo HTTP/1.1
      Accept: application/json
      Content-Type: application/x-www-form-urlencoded
      Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
    
      token=mF_9.B5f-4.1JqM
    

• Get token info using bearer token:

  • token required
  • token_type_hint
    For example:

      POST /tokeninfo HTTP/1.1
      Accept: application/json
      Content-Type: application/x-www-form-urlencoded
      Authorization: Bearer 23410913-abewfq.123483
    
      token=2YotnFZFEjr1zCsicMWpAA&token_type_hint=access_token
    

Given the Access Token obtained during login, this endpoint returns a user's info.

This endpoint will work only if openid was granted as a scope for the Access Token. The user information included in the response depends on the scopes requested.

For example, a scope of just openid may return less information than a a scope of openid profile email.

• profile OPTIONAL. This scope value requests access to the End-User's default profile Claims, which are: name, family_name, given_name, middle_name, nickname, preferred_username, profile, picture, website, gender, birthdate, zoneinfo, locale, and updated_at.
• address OPTIONAL. This scope value requests access to the address Claim.
• email OPTIONAL. This scope value requests access to the email and email_verified Claims.
• phone OPTIONAL. This scope value requests access to the phone_number and phone_number_verified Claims.

Multiple scope values MAY be used by creating a space delimited, case sensitive list of ASCII scope values.

See more

This is the flow that input-constrained devices use to access an API. Use this endpoint to get a device code.

Retrieve filtered list of clients.

Create a client

Retrieve client details.

Modify a client

Delete a client. Default Client cannot be deleted.

Change a client secret

Retrieve resources associated with a client

Authorize resource to client