Token — IdP API

Exchanges grants for access tokens (RFC 6749).

Authorization Code Exchange (§4.1.3)

POST /{issuer_id}/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code={authorization_code}
&redirect_uri={redirect_uri}
&client_id={client_id}
&code_verifier={code_verifier}

Refresh Token Exchange (§6)

POST /{issuer_id}/token
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token
&refresh_token={refresh_token}
&client_id={client_id}

Token Rotation: A new refresh token is issued with each refresh request. The previous refresh token is invalidated.

Client Credentials (§4.4)

For M2M clients (c_ prefix) and agents (agt_ prefix):

POST /{issuer_id}/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&client_id={client_id}
&client_secret={client_secret}
&scope={scope}
&resource={audience}

Or use HTTP Basic auth with client_id:client_secret. Returns an access token only — no refresh token or ID token.

Client Authentication

• Confidential clients must authenticate using HTTP Basic auth or by including client_id and client_secret in the request body
• Public clients must include client_id and use PKCE

Specifications: RFC 6749, RFC 8707