---
title: "Obtain an ID Token"
method: POST
path: "/token"
tags: ["Authentication"]
---

# Obtain an ID Token

`POST /token`

Exchange en authorization code for an ID Token or Access Token.

This endpoint supports both `client_secret_basic` (default) and `client_secret_basic` authentication methods, as specified by the client's `token_endpoint_auth_method`.

## Headers

- `Authorization` string

## Response `200`

Token response

- Token — Successful token response
  - `token_type` string, required
  - `access_token` string — The access token issued by the authorization server.
  - `id_token` string — ID Token value associated with the authenticated session.
  - `refresh_token` string — The refresh token issued to the client, if any.
  - `expires_in` integer — The lifetime in seconds of the access token.
  - `expires_at` integer — The time the access token will expire in seconds since epoch.
  - `scope` string — The scope of the granted tokens.

## Other responses

- `400` — OAuth 2.0 error response
- `401` — OAuth 2.0 error response

## Changes

- **2017-03-12** `517735228177` — 4 warning, 3 info
  - the optional response header `Cache-Control` removed for the status `200`
  - the optional response header `Pragma` removed for the status `200`
  - deleted the `header` request parameter `client_id`
  - deleted the `header` request parameter `client_secret`
  - …3 more

[Change history](https://skmtc.dev/authentiqid/apis/authentiq-connect-api/changes/token/post.md)

---

[API](https://skmtc.dev/authentiqid/apis/authentiq-connect-api.md) · [All operations](https://skmtc.dev/authentiqid/apis/authentiq-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/authentiqid/authentiq-connect-api/revisions/a1689e8baa23/schema)