Skip to main content

Generate Auth Access Token

POST 
/api/id/v1/auth/token

This API endpoint allows clients to obtain OAuth 2.0 access tokens using the client_credentials grant type. The client must provide its client ID and client secret in the Authorization header, using the Basic authentication scheme. The generated access token can then be used to authenticate and access protected resources within the system.

The request body must include the grant_type as client_credentials, and a scope parameter that defines the permissions being requested. The API will return an access token, along with optional tokens such as an ID token or a refresh token if supported.

This endpoint is used for machine-to-machine authentication, where no user interaction is required. The tokens generated can be used to access APIs securely, ensuring that the client is authorized for the requested scopes.

Request​

Header Parameters

    Authorization stringrequired

    The Authorization header must include the client ID and client secret encoded in base64 using the format Basic base64(client_id:client_secret). This header is required to authenticate the client and obtain the OAuth 2.0 access token.

Body

required

    grant_type stringrequired

    Possible values: [client_credentials]

    Specifies the OAuth 2.0 grant type being used. In this case, it must be client_credentials. This indicates that the client is using its own credentials to request an access token.

    scope string

    The scope of the access request. This parameter defines the permissions being requested for the access token. Multiple scopes can be requested, and they should be space-separated. For example, openid email profile inspect can be used to request access to basic identity information and profile data.

Responses​

200 OK. The access token was successfully generated. The response contains the access token and, if applicable, additional tokens (e.g., refresh token or ID token). The data includes:

Schema

    scope string

    The scopes associated with the access token, indicating the granted permissions.

    token_type string

    The type of token issued. Typically, this will be Bearer, indicating that the token is a bearer token, which must be sent in the Authorization header when accessing protected resources.

    access_token string

    The access token issued by the authorization server. This token is used to access protected resources.

    expires_in integer

    The number of seconds for which the access token is valid. Once this time expires, the token must be refreshed or a new one must be obtained.

    id_token string

    The ID token issued by the server, if applicable. This token contains identity-related information.

    refresh_token string

    The refresh token, which can be used to obtain new access tokens without needing to re-authenticate. This field is included if the server supports token refreshing.

Loading...