/token

Request

This endpoint returns access tokens, ID tokens, and refresh tokens depending on the request parameters. For password, client credentials, SAML 2.0 assertion, and refresh token flows, calling /token is the only step of the flow. For the authorization code flow, calling /token is the second step of the flow.

Note: The /token endpoint requires client authentication. The method is configured per client app. See Client authentication methods.

Path

authorizationServerIdstringrequired

id of the authorization server

Bodyapplication/x-www-form-urlencoded

grant_typestring(GrantType)

Determines the mechanism Okta uses to authorize the creation of the tokens

Enum:"authorization_code""client_credentials""implicit""interaction_code""password""refresh_token""urn:ietf:params:oauth:grant-type:device_code""urn:ietf:params:oauth:grant-type:jwt-bearer""urn:ietf:params:oauth:grant-type:saml2-bearer""urn:ietf:params:oauth:grant-type:token-exchange"

Discriminator

codestringrequired

The value is what was returned from the authorization endpoint. The code has a lifetime of 300 seconds.

code_verifierstring

Required if the code_challenge was specified in the original /authorize request. This value is the code verifier for PKCE. Okta uses it to recompute the code_challenge and verify if it matches the original code_challenge in the authorization request.

redirect_uristring

Specifies the callback location where the authorization was sent. This value must match the redirect_uri used to generate the original authorization_code.

resourceArray of strings, (uri)

An absolute URI that identifies the target resource server that's requested the token. The access token's aud claim is set to this value.

Specify at most one value. It must be one of the resources that are specified in the original /authorize request, and it's required if more than one resource is specified in that request. If more than one value is specified, the request fails with an invalid_target error.

Note: Multiple audiences for custom authorization servers is a self-service Early Access (EA) feature. See Manage Early Access and Beta features to enable the feature.

curl -i -X POST \
  'https://subdomain.okta.com/oauth2/{authorizationServerId}/v1/token' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d client_id=0jrabyQWm4B9zVJPbotY \
  -d client_secret=6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc \
  -d grant_type=authorization_code \
  -d redirect_uri=https://www.example.com/oauth2/redirectUri \
  -d 'code=QnowT-aeawtOJKp-MtkH&'

Responses

Based on the scopes requested. The scopes specified in a request are included in the access token in the response.

Bodyapplication/json

access_tokenstring

An access token

device_secretstring

An opaque device secret. This is returned if the device_sso scope is granted.

expires_ininteger

The expiration time of the access token in seconds

id_tokenstring

An ID token. This is returned if the openid scope is granted.

refresh_tokenstring

An opaque refresh token. This is returned if the offline_access scope is granted.

scopestring

The scopes contained in the access token

token_typestring(TokenResponseTokenType)

The token type in a /token response. The value is generally Bearer except for a few instances of token exchange.

Enum:"Bearer""N_A"

issued_token_typestring(TokenTypeCustomAs)

The type of token for token exchange

Enum Value	Description
urn:ietf:params:oauth:token-type:access_token	OAuth 2.0 access token
urn:ietf:params:oauth:token-type:id_token	ID token
urn:ietf:params:oauth:token-type:jwt	JSON Web Token (JWT)
urn:ietf:params:oauth:token-type:refresh_token	OAuth 2.0 refresh token
urn:ietf:params:oauth:token-type:saml1	SAML 1.1 assertion
urn:ietf:params:oauth:token-type:saml2	SAML 2.0 assertion
urn:okta:oauth:token-type:web_sso_token	Web SSO token
urn:x-oath:params:oauth:token-type:device-secret	Device secret
urn:okta:params:oauth:token-type:interclient_token	Interclient token

Response

{
  "access_token": "<access_token_value>",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "openid email offline_access",
  "refresh_token": "a9VpZDRCeFh3Nkk2VdY",
  "id_token": "<id_token_example>"
}