Skip to main content

OAuth token endpoint

POST 
/oauth2/token

Issues tokens by grant_type:

  • authorization_code: a login code and its PKCE verifier for a token set
  • refresh_token: a new token set; the refresh token rotates
  • client_credentials: a confidential client's own access token; no user, refresh token or id token

Other grants return unsupported_grant_type. A confidential client authenticates with HTTP Basic (401 invalid_client on failure); a public client sends client_id with no secret.

Request​

Responses​

A fresh token set, including a new refresh token, sent with Cache-Control: no-store and Pragma: no-cache (RFC 6749 §5.1).