Process Token Request
This API parses request parameters of an authorization request and returns necessary data for the authorization server implementation to process the authorization request further.
Path parameters
A service ID.
Request body
OAuth 2.0 token request parameters which are the request parameters that the OAuth 2.0 token endpoint of the authorization server implementation received from the client application.
The value of parameters is the entire entity body (which is formatted in application/x-www-form-urlencoded) of the request from the client application.
The client ID extracted from Authorization header of the token request from the client application.
If the token endpoint of the authorization server implementation supports basic authentication as a means of client authentication, and the request from the client application contained its client ID in Authorization header, the value should be extracted and set to this parameter.
The client secret extracted from Authorization header of the token request from the client application.
If the token endpoint of the authorization server implementation supports basic authentication as a means of client authentication, and the request from the client application contained its client secret in Authorization header, the value should be extracted and set to this parameter.
The client certificate from the MTLS of the token request from the client application.
The certificate path presented by the client during client authentication. These certificates are strings in PEM format.
DPoP header presented by the client during the request to the token endpoint.
The header contains a signed JWT which includes the public key that is paired with the private key used to sign the JWT. See OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP) for details.
HTTP method of the token request. This field is used to validate the DPoP header.
In normal cases, the value is POST. When this parameter is omitted, POST is used as the default value. See OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP) for details.
URL of the token endpoint. This field is used to validate the DPoP header.
If this parameter is omitted, the tokenEndpoint property of the Service is used as the default value. See OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (DPoP) for details.
The representation of an access token that may be issued as a result of the Authlete API call.
Additional claims that are added to the payload part of the JWT access token.
The value of the OAuth-Client-Attestation HTTP header, which is defined in the specification of OAuth 2.0 Attestation-Based Client Authentication.
The value of the OAuth-Client-Attestation-PoP HTTP header, which is defined in the specification of OAuth 2.0 Attestation-Based Client Authentication.
The duration (in seconds) of the access token that may be issued as a result of the Authlete API call.
When this request parameter holds a positive integer, it is used as the duration of the access token in. In other cases, this request parameter is ignored.
The duration (in seconds) of the refresh token that may be issued as a result of the Authlete API call.
When this request parameter holds a positive integer, it is used as the duration of the refresh token in. In other cases, this request parameter is ignored.
The flag indicating whether to require the DPoP proof JWT to include the nonce claim. Even if the service's dpopNonceRequired property is false, calling the /auth/token API with this dpopNonceRequired parameter true will force the Authlete API to check whether the DPoP proof JWT includes the expected nonce value.
Response
Token operation completed successfully
The code which represents the result of the API call.
A short message which explains the result of the API call.
The next action that the authorization server implementation should take.
The content that the authorization server implementation is to return to the client application. Its format varies depending on the value of action parameter.
The value of username request parameter in the token request. The client application must specify username when it uses Resource Owner Password Grant. In other words, when the value of grant_type request parameter is password, username request parameter must come along.
This parameter has a value only if the value of grant_type request parameter is password and the token request is valid.
The value of password request parameter in the token request. The client application must specify password when it uses Resource Owner Password Grant. In other words, when the value of grant_type request parameter is password, password request parameter must come along.
This parameter has a value only if the value of grant_type request parameter is password and the token request is valid.
The ticket which is necessary to call Authlete's /auth/token/fail API or /auth/token/issue API.
This parameter has a value only if the value of grant_type request parameter is password and the token request is valid.
The newly issued access token.
The datetime at which the newly issued access token will expire. The value is represented in milliseconds since the Unix epoch (1970-01-01).
The duration of the newly issued access token in seconds.
The newly issued refresh token.
The datetime at which the newly issued refresh token will expire. The value is represented in milliseconds since the Unix epoch (1970-01-01).
The duration of the newly issued refresh token in seconds.
The newly issued ID token. Note that an ID token is issued from a token endpoint only when the response_type request parameter of the authorization request to an authorization endpoint has contained code and the scope request parameter has contained openid.
The grant type of the token request.
The client ID.
The client ID alias when the token request was made. If the client did not have an alias, this parameter is null. Also, if the token request was invalid and it failed to identify a client, this parameter is null.
The flag which indicates whether the client ID alias was used when the token request was made. true if the client ID alias was used when the token request was made.
The subject (= resource owner's ID) of the access token. Even if an access token has been issued by the call of /api/auth/token API, this parameter is null if the flow of the token request was Client Credentials Flow (grant_type=client_credentials) because it means the access token is not associated with any specific end-user.
The scopes covered by the access token.
The newly issued access token in JWT format. If the authorization server is configured to issue JWT-based access tokens (= if the service's accessTokenSignAlg value is a non-null value), a JWT-based access token is issued along with the original random-string one.
The resources specified by the resource request parameters in the token request. See "Resource Indicators for OAuth 2.0" for details.
The target resources of the access token being issued. See "Resource Indicators for OAuth 2.0" for details.
Additional claims to be embedded in an ID token.
The client authentication method that was performed at the token endpoint.
the value of the grant_id request parameter of the device authorization request.
The grant_id request parameter is defined in Grant Management for OAuth 2.0 , which is supported by Authlete 2.3 and newer versions.
The audiences on the token exchange request
The token type identifier used in OAuth 2.0 Token Exchange (RFC 8693). The API returns short codes (enum constant names) in response fields.
The token type identifier used in OAuth 2.0 Token Exchange (RFC 8693). The API returns short codes (enum constant names) in response fields.
The token type identifier used in OAuth 2.0 Token Exchange (RFC 8693). The API returns short codes (enum constant names) in response fields.
For RFC 7523 JSON Web Token (JWT) Profile for OAuth 2.0 Client Authentication and Authorization Grants
Indicate whether the previous refresh token that had been kept in the database for a short time was used
The entity ID of the client.
Flag which indicates whether the entity ID of the client was used when the request for the access token was made.
Duration of the c_nonce in seconds.
Get the expected nonce value for DPoP proof JWT, which should be used as the value of the DPoP-Nonce HTTP header.
Get the c_nonce.
Get the time at which the c_nonce expires in milliseconds since the Unix epoch (1970-01-01).
Get the names of the claims that the authorization request (which resulted in generation of the access token) requested to be embedded in ID tokens.
Scopes associated with the refresh token.
The session ID, which is the ID of the user's authentication session, associated with a newly created access token.
If the response from the /auth/token API contains the deviceSecret parameter, its value should be used as the value of this deviceSecret request parameter to the /nativesso API. The authorization server may choose to issue a new device secret; in that case, it is free to generate a new device secret and specify the new value.
The authorization server should compute the hash value of the device secret based on its own logic and specify the computed hash as the value of this deviceSecretHash request parameter to the /nativesso API.
The location of the client's metadata document that was used to resolve client metadata.
This property is set when client metadata was retrieved via the OAuth Client ID Metadata Document (CIMD) mechanism.
Flag indicating whether a metadata document was used to resolve client metadata for this request.
When true, the client metadata was retrieved via the CIMD mechanism rather than from the Authlete database.