Token Endpoint

Exchange various types of credentials for access tokens, ID tokens, and refresh tokens. This endpoint is the core of OAuth 2.0 token exchange and supports multiple grant types.

Supported Grant Types:

• authorization_code - Exchange authorization code for tokens (Authorization Code Flow)
• authorization_code + code_verifier - Exchange with PKCE (Authorization Code Flow with PKCE)
• refresh_token - Get new access token using refresh token
• client_credentials - Machine-to-machine authentication
• password - Resource Owner Password flow
• urn:ietf:params:oauth:grant-type:device_code - Device authorization flow
• http://auth0.com/oauth/grant-type/mfa-otp - MFA verification with OTP
• http://auth0.com/oauth/grant-type/mfa-oob - MFA verification with OOB
• http://auth0.com/oauth/grant-type/mfa-recovery-code - MFA verification with recovery code
• http://auth0.com/oauth/grant-type/passwordless/otp - Passwordless authentication
• urn:ietf:params:oauth:grant-type:token-exchange - Token exchange for native social

The request body parameters vary based on the grant_type. See the examples below for each flow.

POST https://{yourDomain}/oauth/token

Token Endpoint

cURL

curl --request POST \
  --url https://{yourDomain}/oauth/token \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=authorization_code \
  --data 'code=<string>' \
  --data 'client_id=<string>' \
  --data 'redirect_uri=<string>' \
  --data 'client_secret=<string>' \
  --data 'audience=<string>' \
  --data 'client_assertion=<string>' \
  --data client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer

200

withRefreshToken

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyMzQ1In0...",
  "refresh_token": "v1.MRHbz1VqR_y42v...",
  "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 86400,
  "scope": "openid profile email offline_access"
}

Authorizations

Authorization · string · header · required

The access token received from the authorization server in the OAuth 2.0 flow.

Headers

DPoP · string

A DPoP proof JWT for enhanced security. Required only if your application uses Demonstrating Proof-of-Possession (DPoP).

Body

application/x-www-form-urlencodedapplication/json

Authorization Code

Authorization Code (PKCE)

Refresh Token

Client Credentials

Resource Owner Password

Device Authorization

MFA with OTP

MFA with OOB

MFA with Recovery Code

Passwordless with OTP

Token Exchange (Native Social)

Authorization Code Grant - Exchange an authorization code for tokens. Used by server-side web applications that can securely store a client secret.

grant_type · enum<string> · required

Must be 'authorization_code'

Available options: authorization_code

code · string · required

The authorization code received from the authorization endpoint

client_id · string · required

Your application's Client ID

redirect_uri · string<uri> · required

The same redirect_uri used in the authorization request. Must match exactly.

client_secret · string

Your application's Client Secret. Required for confidential clients.

audience · string

The unique identifier of the target API you want to access

client_assertion · string

A JWT signed with your client secret or private key (for Private Key JWT authentication)

client_assertion_type · enum<string>

Must be 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer' when using client_assertion

Available options: urn:ietf:params:oauth:client-assertion-type:jwt-bearer

Response

200

application/json

Successful token exchange. Returns access token and optionally ID token and refresh token.

Successful token response containing access token and optionally ID token and refresh token

access_token · string · required

The access token issued by the authorization server. Use this token to access protected resources (APIs).

Example:

"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyMzQ1In0..."

token_type · enum<string> · required

The type of the token issued. Always 'Bearer' for Auth0.

Available options: Bearer

Example:

"Bearer"

expires_in · integer · required

The lifetime in seconds of the access token. After this time, the token will expire and can no longer be used.

Example:

86400

refresh_token · string

The refresh token which can be used to obtain new access tokens. Only returned if 'offline_access' scope was requested.

Example:

"v1.MRHbz1VqR_y42v..."

id_token · string

The ID Token containing user profile information. Only returned if 'openid' scope was requested. This is a JWT containing user claims.

Example:

"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."

scope · string

The scopes granted by the authorization server. May differ from requested scopes.

Example:

"openid profile email"