Issue an access token

Server URLloading...

POST

/oauth/token

Send

Body

The token endpoint for all three supported grants.

client_credentials is the grant for API clients. Authenticate with HTTP Basic, sending the client id as the username and the client secret as the password (client_secret_basic), or put both in the form body (client_secret_post). Omit scope to receive everything the client was granted, or pass a space-separated subset to narrow it.

authorization_code completes a browser flow started at /oauth/authorize and requires the PKCE code_verifier. refresh_token exchanges a refresh token for a new access token.

Responses are never cached: the endpoint sets Cache-Control: no-store.

Response Body

curl -X POST "https://example.com/oauth/token" \  -H "Content-Type: application/x-www-form-urlencoded" \  -d 'grant_type=client_credentials'

{  "access_token": "string",  "token_type": "Bearer",  "expires_in": 0,  "refresh_token": "string",  "scope": "string",  "id_token": "string"}