Sign in
Token Endpoint

Issue Token Response

This API generates a content of a successful token response that the authorization server implementation returns to the client application.

Description

This API is supposed to be called from within the implementation of the token endpoint of the service in order to generate a successful response to the client application. The description of the /auth/token API describes the timing when this API should be called. See the description for the case of action=PASSWORD. The response from /auth/token/issue API has some parameters. Among them, it is action parameter that the authorization server implementation should check first because it denotes the next action that the authorization server implementation should take. According to the value of action, the authorization server implementation must take the steps described below. INTERNAL_SERVER_ERROR When the value of action is INTERNAL\_SERVER\_ERROR, it means that the request from the authorization server implementation was wrong or that an error occurred in Authlete. In either case, from the viewpoint of the client application, it is an error on the server side. Therefore, the service implementation should generate a response to the client application with HTTP status of "500 Internal Server Error". The value of responseContent is a JSON string which describes the error, so it can be used as the entity body of the response. The following illustrates the response which the service implementation should generate and return to the client application.

HTTP/1.1 500 Internal Server Error
Content-Type: application/json
Cache-Control: no-store
Pragma: no-cache
{responseContent}

The endpoint implementation may return another different response to the client application since "500 Internal Server Error" is not required by OAuth 2.0. OK When the value of action is OK, it means that Authlete's /auth/token/issue API successfully generated an access token. The HTTP status of the response returned to the client application must be "200 OK" and the content type must beapplication/json. The value of responseContent is a JSON string which contains an access token, so it can be used as the entity body of the response. The following illustrates the response which the service implementation must generate and return to the client application.

HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store
Pragma: no-cache
{responseContent}
post/api/{serviceId}/auth/token/issue

Path parameters

serviceIdstring required

A service ID.

Request body

ticketstring required

The ticket issued from Authlete /auth/token API.

subjectstring required

The subject (= unique identifier) of the authenticated user.

jwtAtClaimsstring

Additional claims that are added to the payload part of the JWT access token.

accessTokenstring

The representation of an access token that may be issued as a result of the Authlete API call.

accessTokenDurationinteger

The duration (in seconds) of the access token that may be issued as a result of the Authlete API call.

When this request parameter holds a positive integer, it is used as the duration of the access token in. In other cases, this request parameter is ignored.

refreshTokenDurationinteger

The duration (in seconds) of the refresh token that may be issued as a result of the Authlete API call.

When this request parameter holds a positive integer, it is used as the duration of the refresh token in. In other cases, this request parameter is ignored.

Response

Token issued successfully

resultCodestring

The code which represents the result of the API call.

resultMessagestring

A short message which explains the result of the API call.

action'INTERNAL_SERVER_ERROR' | 'OK'

The next action that the authorization server implementation should take.

responseContentstring

The content that the authorization server implementation is to return to the client application. Its format is JSON.

accessTokenstring

The newly issued access token. This parameter is a non-null value only when the value of action parameter is OK.

accessTokenExpiresAtinteger

The datetime at which the newly issued access token will expire. The value is represented in milliseconds since the Unix epoch (1970-01-01).

accessTokenDurationinteger

The duration of the newly issued access token in seconds.

refreshTokenstring

The refresh token. This parameter is a non-null value only when action is OK and the service supports the refresh token flow. If refreshTokenKept is set to false, a new refresh token is issued and the old refresh token used in the refresh token flow is invalidated. On the contrary, if refreshTokenKept is set to true, the refresh token itself is not refreshed.

refreshTokenExpiresAtinteger

The datetime at which the newly issued refresh token will expire. The value is represented in milliseconds since the Unix epoch (1970-01-01).

refreshTokenDurationinteger

The duration of the newly issued refresh token in seconds.

clientIdinteger

The client ID.

clientIdAliasstring

The client ID alias. If the client did not have an alias, this parameter is null.

clientIdAliasUsedboolean

The flag which indicates whether the client ID alias was used when the token request was made. true if the client ID alias was used when the token request was made.

subjectstring

The subject (= resource owner's ID) of the access token. Even if an access token has been issued by calling /api/auth/token API, this parameter is null if the flow of the token request was Client Credentials Flow (grant_type=client_credentials) because it means the access token is not associated with any specific end-user.

scopesstring[]

The scopes covered by the access token.

jwtAccessTokenstring

The newly issued access token in JWT format. If the authorization server is configured to issue JWT-based access tokens (= if the service's accessTokenSignAlg value is a non-null value), a JWT-based access token is issued along with the original random-string one.

accessTokenResourcesstring[]

The target resources of the access token being issued. See "Resource Indicators for OAuth 2.0" for details.

clientEntityIdstring

The entity ID of the client.

clientEntityIdUsedboolean

Flag which indicates whether the entity ID of the client was used when the request for the access token was made.

refreshTokenScopesstring[]

The scopes associated with the refresh token. May be null.

metadataDocumentLocationstring uri

The location of the client's metadata document that was used to resolve client metadata.

This property is set when client metadata was retrieved via the OAuth Client ID Metadata Document (CIMD) mechanism.

metadataDocumentUsedboolean

Flag indicating whether a metadata document was used to resolve client metadata for this request.

When true, the client metadata was retrieved via the CIMD mechanism rather than from the Authlete database.

Changes