Token Endpoint

Overview

The Token Endpoint is used by clients to exchange an authorization code, refresh tokens, client credentials or token exchange for OAuth 2.0 tokens (Access Token, Refresh Token, and optionally an ID Token).

It is typically called by back-end components (not the browser) using HTTPS POST requests.

Endpoint

The endpoint is advertised in the authorization_endpoint in the metadata exposed by the discovery endpoint and typically is:

POST https://[BASE_URL]/connect/token

Parameters (form-encoded)

Parameter Required Description
grant_type Yes The grant type (authorization_code, refresh_token, client_credentials, etc.).
code Required for authorization_code The authorization code received from the Authorization Endpoint.
redirect_uri Required for authorization_code Must match the original redirect_uri used in the request.
client_id Required (if not using client authentication header) The client identifier.
client_secret Required (for confidential clients) The client’s secret.
code_verifier Required for PKCE The original code verifier for PKCE-enabled flows.
refresh_token Required for refresh_token grant The refresh token issued earlier.
subject_token Required for token exchange. An access token issued by Authway or a login hint token.
subject_token_type Required for token exchange. The type of token passed in subject_token.
actor_token Optional for token exchange. The access token representing the client that makes a token exchange. Used for delegation.
actor_token_type Optional for token exchange, but required when passing actor_token. The type of token passed in actor_token.
requested_token_type Optional for token exchange. The type of token that should be returned in token exchange. Authway only supports access_token currently.
audience Optional for token exchange. The name of the resource where the response token should be used.

Response

Successful responses are JSON objects containing issued tokens, for example:

{
   "access_token": "SlAV32hkKG",
   "token_type": "Bearer",
   "expires_in": 3600,
   "refresh_token": "8xLOxBtZp8",
   "id_token": "eyJhbGciOiJSUzI1..." 
}

Usage (Authorization Code Flow with PKCE)

  1. Obtain Authorization Code:
    From the Authorization Endpoint.

  2. Send Token Request:

HTTP POST /connect/token
 Content-Type: application/x-www-form-urlencoded
 Authorization: Basic base64(client_id:client_secret)
 grant_type=authorization_code&
 code=SplxlOBeZQQYbYS6WxSbIA&
 redirect_uri=https%3A%2F%2Frp.example.com%2Fcallback&
 code_verifier=abcdef123456
  1. Receive Tokens:
    The IdP responds with an Access Token, ID Token (if OIDC), and optionally a Refresh Token.

Security Considerations

  • Never expose client_secret in public clients (use PKCE instead).
  • Validate all tokens received (signature, expiration, audience, nonce).