Identity Provider

Token endpoint

Exchanges an authorization code (with code_verifier) or a refresh token. Codes are single use and live 5 minutes; a failed exchange burns the code. Client authentication: client_secret_basic, client_secret_post, or none (open clients and registered public clients). Registered clients, and any grant that included offline_access, receive a refresh token (30 days, rotated on every use; a reused refresh token is rejected). Accepts application/x-www-form-urlencoded or JSON.

post/token

Request

  • Base URL: https://id.deadsimple.email
  • URL: https://id.deadsimple.email/token
  • Auth: none required

Response

Tokens issued.

access_tokenstring

Opaque dse_idt_ token for /userinfo. Lives 1 hour.

token_typestring
expires_ininteger
id_tokenstring

ES256 JWT, verify against /.well-known/jwks.json. Lives 1 hour.

scopestring
refresh_tokenstring

dse_idr_ token, 30 days, rotated on every use. Only for registered clients or when offline_access was granted.

Example response

{
  "token_type": "Bearer",
  "expires_in": 3600
}

Changes

No recorded changes to this operation across all 1 revision of this API.