IBibm
Token Endpoint

Use this endpoint to obtain an access token

The token endpoint is used by the client to obtain an access token by presenting its authorization grant or refresh token. The token endpoint is used with every authorization grant except for the implicit grant type (since an access token is issued directly).

post/token

Request

  • Base URL
    https://{pointofcontact}/oauth2
  • Auth
    HTTP basic

Headers

x-client-certificatestring

MTLS Client Certificate

Request body application/x-www-form-urlencoded

grant_type'authorization_code' | 'password' | 'client_credentials' | 'refresh_token' | 'urn:openid:params:grant-type:ciba' required

Grant type string that the client can use at the token endpoint

codestring

The authorization code received from OIDC Provider. Required when doing authorization_code flow.

code_verifierstring

Code verifier used as proof for code exchange. It is used in authorization_code flow when code_challenge and code_challenge_method are included in the authorization request.

redirect_uristring

Redirection URI having the same value as it was included in the authorization request. It is only used in authorization_code flow.

usernamestring

The resource owner username. Required for resource owner password credentials (ROPC) flow.

passwordstring

The resource owner password. Required for resource owner password credentials (ROPC) flow.

refresh_tokenstring

The refresh token issued to the client. Required for refresh token flow.

auth_req_idstring

A unique identifier to identify the authentication request made by the backchannel Client. This is required for client initiated backchannel authentication (CIBA) flow.

scopestring

Space-delimited string indicating the scope associated with access request.

client_idstring

OAuth2.0 client identifier. Required when the client authentication method is using "client_secret_post" or "tls_client_auth". It is optional when using "private_key_jwt" client authentication; when specified it MUST match the "client_assertion" subject.

client_secretstring

OAuth2.0 client secret. May be specified when using "client_secret_post" client authentication method.

client_assertionstring

The "private_key_jwt" assertion being used to authenticate the client.

client_assertion_type'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'

Type of the client assertion.

Response

Token response

id_tokenstring

ID Token (JWT) associated with the authenticated session.

access_tokenstring required

The access token issued by the authorization server.

token_type'Bearer' required

The type of the token issued.

expires_innumber required

The lifetime in seconds of the access token.

scopestring

Space-delimited string containing the scope associated with the access token

refresh_tokenstring

The refresh token issued by the authorization server.

Changes

No recorded changes to this operation across all 1 revision of this API.