Token endpoint is used directly by the client without involving the browser. Hence, it is possible to get an access token offline when the user is not connected via a browser. This endpoint can issue an access token when the client provides either a valid authorization code, SAML2 bearer profile for authorization grant flow, resource owner credentials, or client credentials.
Endpoint URL: https://<Identity Server hostname>/nidp/oauth/nam/token
Request method: POST
The token request should have the following parameters:
|
Parameter |
Required |
Description |
|---|---|---|
|
resourceServer |
No |
Registered resource server name.If this parameter is present, the authorization server will use the respective configured way to encrypt the access token. |
|
grant_type |
Yes |
authorization_code Use 'urn:ietf:params:oauth:grant-type:saml2-bearer' as value for this parameter. |
|
assertion |
Yes |
(For SAML bearer grant) A single base64url encoded SAML2.0 Assertion as value for this parameter. |
|
client_id |
Yes |
Client ID of the registered client. |
|
client_secret |
Optional |
Client Secret of the registered client. It is optional for native application, for web application secret is mandatory. |
|
code |
Yes |
Code received in the Authorization code flow. |
|
redirect_uri |
Yes |
This should be same as the one sent during the authorization code request. |
|
device_id |
Optional |
Specify device id that token to be associated with device. |
|
refresh_token |
Yes |
refresh_token that is obtained during authorization grant, resource owner credentials. |
|
scope |
Optional |
List of scopes the application requires. Scope values should be separated using space (%20 or +). |
|
Parameter |
Required |
Description |
|---|---|---|
|
token_type |
Yes |
The type of the token. Authorization server currently supports only Bearer type. |
|
access_token |
Yes |
Access token that can be used to invoke resource server APIs. |
|
id_token |
Optional if scope contains "OpenID" |
When invoking authorization code request, if the client has sent OpenID, this response object will contain an ID Token. |
|
scope |
Optional |
The list of scopes that user has authorized. This can contain all the scopes the client requested or lesser. |
|
state |
Optional |
if the "state" parameter was present in the client authorization request, the same state value sends in response. |
NOTE:Ensure that you do not use the Expect: 100-Continue header in the request when using a multi-node IDP cluster setup. If the request contains this header you may experience HTTP 400 Bad Request. If you are using CURL, use "-H 'Expect:'" or do not include IDP cookies.