DIdigicert
CSC (v0)

Get access token

Use this endpoint to get the access token using authentication details.

post/csc/v0/oauth2/token

Request

Request body

grant_typestring required

The grant type, which depends on the type of OAuth 2.0 flow.

codestring

The authorization code returned by the authorization server. It SHALL be bound to the client identifier and the redirection URI. This SHALL be used only when grant_type is “authorization_code”.

client_idstring required

The client_id as defined in the Input parameter table in section 8.3.2.

client_secretstring

This is the “client secret” previously assigned to the signature application by the remote service. It SHALL be passed if no authorization header and no client assertion is used.

redirect_uristring

The URL where the user was redirected after the authorization process completed. It is used to validate that it matches the original value previously passed to the authorization server. This SHALL be used only if the redirect_uri parameter was included in the authorization request, and their values SHALL be identical.

client_datastring

Arbitrary data from the Signature Application. It can be used to handle a transaction identifier or other application-specific data.

Example request

{
  "grant_type": "authorization_code",
  "code": "FhkXf9P269L8g",
  "client_id": "<OAuth2_client_id>",
  "client_secret": "<OAuth2_client_secret>",
  "redirect_uri": "<OAuth2_redirect_uri>"
}

Response

Remote service details

access_tokenstring

The short-lived access token to be used depending on the scope of the OAuth 2.0 authorization request. When the scope is “service” then the authorization server returns a bearer token to be used as the value of the “Authorization- Bearer” in the HTTP header of the subsequent API requests within the same session. When the scope is “credential” then the authorization server returns a Signature Activation Data token to authorize the signature request. This value SHOULD be used as the value for the SAD parameter when invoking the signatures/signHash method, as defined in section 11.9.

refresh_tokenstring

The long-lived refresh token used to re-authenticate the user on the subsequent session based on the method described in Section 1.5 of RFC 6749 [11]. The presence of this parameter is controlled by the user and is allowed only when the scope of the OAuth 2.0 authorization request is “service”. In case grant_type is “refresh_token” the authorization server MAY issue a new refresh token, in which case the client SHALL discard the old refresh token and replace it with the new refresh token.

token_typestring

When the scope is “service”, this specifies a "Bearer" token type as defined in RFC6750 [12]. When the scope is “credential”, this specifies a “SAD” token type.

expires_ininteger

The lifetime in seconds of the service access token. If omitted, the default expiration time is 3600 sec. (1 hour).

Example response

{
  "access_token": "4/CKN69L8gdSYp5_pwH3XlFQZ3ndFhkXf9P2_TiHRG-bA",
  "refresh_token": "_TiHRG-bA H3XlFQZ3ndFhkXf9P24/CKN69L8gdSYp5_pw\"",
  "token_type": "Bearer",
  "expires_in": 3600
}

Changes

No recorded changes to this operation across all 1 revision of this API.