Skip to main content
POST
Token Endpoint
Client authentication: Use HTTP Basic (Authorization: Basic base64(client_id:client_secret)) or pass client_id / client_secret in the request body.
authorization_code | client_credentials | refresh_token
required
The OAuth 2.0 grant type.
For authorization_code:
string
The authorization code received from the /authorize redirect.
string
Must match the redirect_uri used in the authorization request.
string
The original PKCE code verifier (required if code_challenge was used).
For client_credentials:
string
Space-separated scopes to request.
For refresh_token:
string
A valid refresh token issued by a previous token request.
string
JWT access token.
string
Bearer
number
Expiry in seconds (default: 3600).
string
OIDC ID token (only when openid scope was requested).
string
Refresh token (only for authorization_code grant).
string
Granted scopes.