Skip to content
Port OS

OAuth2 Token Endpoint

← HTTP API reference
View source specification ↗
POST /auth/token

This API is used to generate OAuth2 tokens.

The current OAuth token endpoint supports:

  1. Refresh token grants.
  2. Authorization code token grants.

Public DCR/CIMD clients exchange authorization_code with client_id, redirect_uri, code_verifier and the same resource as the consent request. No client_secret is issued. Refresh these grants with grant_type refresh_token, client_id, rotating refresh_token and the original resource. Store the replacement securely.

Required scope

Not required

Request body

Fields

grant_typestringRequired

The OAuth grant type. Use authorization_code for code exchange, or refresh_token to exchange a refresh token for an access token.

client_idstringRequired

The client ID.

client_secretstring

Required for confidential clients. Public DCR/CIMD clients omit this field and use PKCE.

subject_tokenstring

Identity token to exchange; required for urn:ietf:params:oauth:grant-type:token-exchange.

subject_token_typestring

Subject token type; use urn:ietf:params:oauth:token-type:id_token for identity token exchange.

requested_token_typestring

Requested token type for identity token exchange.

audiencestring

Target audience for identity token exchange.

device_codestring

Device code; required for urn:ietf:params:oauth:grant-type:device_code.

codestring

Authorization code; required when grant_type is authorization_code.

refresh_tokenstring

The refresh token; required when grant_type is refresh_token.

redirect_uristring

Redirect URI; required when grant_type is authorization_code.

code_verifierstring

Original PKCE verifier; required for public-client code exchange.

resourcestring

Exact resource from authorization; canonical issuer for REST or issuer/mcp for MCP. Required for DCR and CIMD.

format: "uri"

scopestring

Optional narrower subset during refresh; cannot add scopes.

client_assertionstring

Signed JWT proving client identity (RFC 7523); required with client_assertion_type for private_key_jwt clients using the client_credentials grant.

maxLength: 8192

client_assertion_typestring

Must be urn:ietf:params:oauth:client-assertion-type:jwt-bearer when client_assertion is set.

Allowed values: urn:ietf:params:oauth:client-assertion-type:jwt-bearer.

Returns

200

Token generated successfully

Fields

access_tokenstringRequired

The access token

token_typestringRequired

The token type

expires_inintegerRequired

The token expiration time in seconds

refresh_tokenstring

Rotating refresh credential for resource-bound grants; store privately.

scopestring

Granted space-separated scopes.

Errors

400

Invalid request payload

Check the request fields and any validation details, then correct the payload.

500

Internal server error

Retry with backoff only when the operation is safe to repeat. Include the error code when reporting persistent failures.