GenerateTokenRequest

GenerateTokenRequest fields

grant_typestringRequired

The OAuth grant type. Use authorization_code for code exchange, or refresh_token to exchange a refresh token for an access token.

client_idstringRequired

The client ID.

client_secretstring

Required for confidential clients. Public DCR/CIMD clients omit this field and use PKCE.

subject_tokenstring

Identity token to exchange; required for urn:ietf:params:oauth:grant-type:token-exchange.

subject_token_typestring

Subject token type; use urn:ietf:params:oauth:token-type:id_token for identity token exchange.

requested_token_typestring

Requested token type for identity token exchange.

audiencestring

Target audience for identity token exchange.

device_codestring

Device code; required for urn:ietf:params:oauth:grant-type:device_code.

codestring

Authorization code; required when grant_type is authorization_code.

refresh_tokenstring

The refresh token; required when grant_type is refresh_token.

redirect_uristring

Redirect URI; required when grant_type is authorization_code.

code_verifierstring

Original PKCE verifier; required for public-client code exchange.

resourcestring

Exact resource from authorization; canonical issuer for REST or issuer/mcp for MCP. Required for DCR and CIMD.

format: "uri"

scopestring

Optional narrower subset during refresh; cannot add scopes.

client_assertionstring

Signed JWT proving client identity (RFC 7523); required with client_assertion_type for private_key_jwt clients using the client_credentials grant.

maxLength: 8192

client_assertion_typestring

Must be urn:ietf:params:oauth:client-assertion-type:jwt-bearer when client_assertion is set.

Allowed values: urn:ietf:params:oauth:client-assertion-type:jwt-bearer.