Create Access Token
Create an access token.
Path parameters
A service ID.
Request body
The grant type of the access token when the access token was created.
The ID of the client application which will be associated with a newly created access token.
The subject (= unique identifier) of the user who will be associated with a newly created access token. This parameter is required unless the grant type is CLIENT_CREDENTIALS. The value must consist of only ASCII characters and its length must not exceed 100.
The scopes which will be associated with a newly created access token. Scopes that are not supported by the service cannot be specified and requesting them will cause an error.
The duration of a newly created access token in seconds. If the value is 0, the duration is determined according to the settings of the service.
The duration of a newly created refresh token in seconds. If the value is 0, the duration is determined according to the settings of the service.
A refresh token is not created (1) if the service does not support REFRESH_TOKEN, or (2) if the specified grant type is either IMPLICITor CLIENT_CREDENTIALS.
A boolean request parameter which indicates whether to emulate that the client ID alias is used instead of the original numeric client ID when a new access token is created.
The value of the new access token.
The value of the new refresh token.
Get whether the access token expires or not. By default, all access tokens expire after a period of time determined by their service.
If this request parameter is true, then the access token will not automatically expire and must be revoked or deleted manually at the service. If this request parameter is true, the accessTokenDuration request parameter is ignored.
The thumbprint of the MTLS certificate bound to this token. If this property is set, a certificate with the corresponding value MUST be presented with the access token when it is used by a client. The value of this property must be a SHA256 certificate thumbprint, base64url encoded.
The thumbprint of the public key used for DPoP presentation of this token. If this property is set, a DPoP proof signed with the corresponding private key MUST be presented with the access token when it is used by a client. Additionally, the token's token_type will be set to 'DPoP'.
The value of the resources to associate with the token. This property represents the value of one or more resource request parameters which is defined in "RFC8707 Resource Indicators for OAuth 2.0".
the flag which indicates whether the access token is for an external attachment.
Additional claims that are added to the payload part of the JWT access token.
The Authentication Context Class Reference of the user authentication that the authorization server performed during the course of issuing the access token.
The time when the user authentication was performed during the course of issuing the access token.
Flag which indicates whether the entity ID of the client was used when the request for the access token was made.
The client Identifier associated with the newly issued access token.
The session ID, which is the ID of the user's authentication session, associated with a newly created access token.
Flag indicating whether a metadata document was used to resolve client metadata for this request.
When true, the client metadata was retrieved via the OAuth Client ID Metadata Document (CIMD) mechanism rather than from the Authlete database.
Response
Token created successfully
The code which represents the result of the API call.
A short message which explains the result of the API call.
The next action that the authorization server implementation should take.
The newly issued access token.
The ID of the client application associated with the access token.
The time at which the access token expires.
The duration of the newly issued access token in seconds.
The grant type for the newly issued access token.
The newly issued refresh token.
Scopes which are associated with the access token.
The subject (= unique identifier) of the user associated with the newly issued access token.
The token type of the access token.
If the authorization server is configured to issue JWT-based access tokens (= if Service.accessTokenSignAlg is set to a non-null value), a JWT-based access token is issued along with the original random-string one.
the flag which indicates whether the access token is for an external attachment.
Set the unique token identifier.
The scopes associated with the refresh token. May be null.
The client Identifier that will be associated with a newly created access token.
The session ID associated with a newly created access token.
NOTE: A refresh token must be associated with a session ID, which is the ID of the user's authentication session, in order to be used to obtain a Native SSO-compliant ID token in the refresh token flow.