---
title: "POST /token"
method: POST
path: "/token"
---

# POST /token

`POST /token`

Creates and returns an access token for the authorized client. The access token issued will be used to fetch short-term credentials for the assigned roles in the AWS account.

## Request body

- object
  - `clientId` string, required — The unique identifier string for each client. This value should come from the persisted result of the <a>RegisterClient</a> API.
  - `clientSecret` string, required — A secret string generated for the client. This value should come from the persisted result of the <a>RegisterClient</a> API.
  - `grantType` string, required — <p>Supports grant types for the authorization code, refresh token, and device code request. For device code requests, specify the following value:</p> <p> <code>urn:ietf:params:oauth:grant-type:<i>device_code</i> </code> </p> <p>For information about how to obtain the device code, see the <a>StartDeviceAuthorization</a> topic.</p>
  - `deviceCode` string — Used only when calling this API for the device code grant type. This short-term code is used to identify this authentication attempt. This should come from an in-memory reference to the result of the <a>StartDeviceAuthorization</a> API.
  - `code` string — The authorization code received from the authorization service. This parameter is required to perform an authorization grant request to get access to a token.
  - `refreshToken` string — <p>Currently, <code>refreshToken</code> is not yet implemented and is not supported. For more information about the features and limitations of the current IAM Identity Center OIDC implementation, see <i>Considerations for Using this Guide</i> in the <a href="https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/Welcome.html">IAM Identity Center OIDC API Reference</a>.</p> <p>The token used to obtain an access token in the event that the access token is invalid or expired.</p>
  - `scope` Scope[] — The list of scopes that is defined by the client. Upon authorization, this list is used to restrict permissions when granting an access token.
  - `redirectUri` string — The location of the application that will receive the authorization code. Users authorize the service to send the request to this location.

## Response `200`

Success

- CreateTokenResponse
  - `accessToken` string — An opaque token to access IAM Identity Center resources assigned to a user.
  - `tokenType` string — Used to notify the client that the returned token is an access token. The supported type is <code>BearerToken</code>.
  - `expiresIn` integer — Indicates the time in seconds when an access token will expire.
  - `refreshToken` string — <p>Currently, <code>refreshToken</code> is not yet implemented and is not supported. For more information about the features and limitations of the current IAM Identity Center OIDC implementation, see <i>Considerations for Using this Guide</i> in the <a href="https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/Welcome.html">IAM Identity Center OIDC API Reference</a>.</p> <p>A token that, if present, can be used to refresh a previously issued access token that might have expired.</p>
  - `idToken` string — <p>Currently, <code>idToken</code> is not yet implemented and is not supported. For more information about the features and limitations of the current IAM Identity Center OIDC implementation, see <i>Considerations for Using this Guide</i> in the <a href="https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/Welcome.html">IAM Identity Center OIDC API Reference</a>.</p> <p>The identifier of the user that associated with the access token, if present.</p>

## Other responses

- `480` — InvalidRequestException
- `481` — InvalidClientException
- `482` — InvalidGrantException
- `483` — UnauthorizedClientException
- `484` — UnsupportedGrantTypeException
- `485` — InvalidScopeException
- `486` — AuthorizationPendingException
- `487` — SlowDownException
- `488` — AccessDeniedException
- `489` — ExpiredTokenException
- `490` — InternalServerException

---

[API](https://skmtc.net/aws/apis/sso-oidc.md) · [All operations](https://skmtc.net/aws/apis/sso-oidc/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/sso-oidc/versions/106a5b18f52b/schema)