Oauth Token

OAuth 2.0 token endpoint.

Supports authorization_code, refresh_token, urn:ietf:params:oauth:grant-type:device_code (RFC 8628), and urn:ietf:params:oauth:grant-type:token-exchange (RFC 8693) grant types.

SECURITY POLICY: PKCE (RFC 7636) with S256 is REQUIRED for authorization_code grant. Clients must provide code_verifier parameter when exchanging authorization codes.

RFC 8707: The resource parameter identifies the target resource server for which the token is being requested.

Per RFC 6749 Section 2.3.1, clients can authenticate via:

• HTTP Basic authentication (Authorization header)
• Request body parameters (client_id and client_secret)

Clients MUST NOT use both authentication methods simultaneously.

Per RFC 6749 Section 4.1.3, client_id is REQUIRED only if the client is not authenticating with the authorization server (e.g., via Authorization header).

This deployment permits token exchange without separate client authentication because native/DCR callers are public clients and the signed subject_token is the credential. Exchanges are restricted to same-origin, downscoped resource tokens. RFC 8693 leaves client authentication to deployment policy.