Sign in
oauth

Token exchange

Exchange auth code for access token as part of sgID authorization code flow (to be deprecated)

post/v1/oauth/token

Request body

client_idstring required

sgID client ID which was provided to you during client registration

client_secretstring required

sgID client secret which was provided to you during client registration

codestring required

Authorization code that was received from the callback URL after the user authenticates with Singpass

grant_typestring required

This field must take the value authorization_code as sgID only supports the OAuth 2.0 authorization code flow

Example request

{
  "client_id": "MYCLIENT-PROD",
  "client_secret": "abcabc[...]abcabc",
  "code": "abcdefg12345678[...]gfedcba",
  "grant_type": "authorization_code"
}

Response

Successful token exchange

access_tokenstring

Access Token to be used with retrieving the encrypted payload from user info endpoint

id_tokenstring

JWT token with the associated user claims. Encodes the following:

  • iss (hostname)
  • sub (end user's unique identifier)
  • aud (client id)
  • nonce (only returned if provided in authorization url)
  • exp (seconds before auth request and access token expires)
  • iat (timestamp at which id token was issued)

Changes