Token Endpoint

Exchange various types of credentials for access tokens, ID tokens, and refresh tokens. This endpoint is the core of OAuth 2.0 token exchange and supports multiple grant types.

Supported Grant Types:

• authorization_code - Exchange authorization code for tokens (Authorization Code Flow)
• authorization_code + code_verifier - Exchange with PKCE (Authorization Code Flow with PKCE)
• refresh_token - Get new access token using refresh token
• client_credentials - Machine-to-machine authentication
• password - Resource Owner Password flow
• urn:ietf:params:oauth:grant-type:device_code - Device authorization flow
• http://auth0.com/oauth/grant-type/mfa-otp - MFA verification with OTP
• http://auth0.com/oauth/grant-type/mfa-oob - MFA verification with OOB
• http://auth0.com/oauth/grant-type/mfa-recovery-code - MFA verification with recovery code
• http://auth0.com/oauth/grant-type/passwordless/otp - Passwordless authentication
• urn:ietf:params:oauth:grant-type:token-exchange - Token exchange for native social

The request body parameters vary based on the grant_type. See the examples below for each flow.

POST https://{yourDomain}/oauth/token

Token Endpoint

cURL

curl --request POST \
  --url https://{yourDomain}/oauth/token \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=authorization_code \
  --data 'code=<string>' \
  --data 'client_id=<string>' \
  --data 'redirect_uri=<string>' \
  --data 'client_secret=<string>' \
  --data 'audience=<string>' \
  --data 'client_assertion=<string>' \
  --data client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer

200

withRefreshToken

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyMzQ1In0...",
  "refresh_token": "v1.MRHbz1VqR_y42v...",
  "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 86400,
  "scope": "openid profile email offline_access"
}

Autorisations

Authorization · string · header · requis

The access token received from the authorization server in the OAuth 2.0 flow.

En-têtes

DPoP · string

A DPoP proof JWT for enhanced security. Required only if your application uses Demonstrating Proof-of-Possession (DPoP).

Corps

application/x-www-form-urlencodedapplication/json

Authorization Code

Authorization Code (PKCE)

Refresh Token

Client Credentials

Resource Owner Password

Device Authorization

MFA with OTP

MFA with OOB

MFA with Recovery Code

Passwordless with OTP

Token Exchange (Native Social)

Authorization Code Grant - Exchange an authorization code for tokens. Used by server-side web applications that can securely store a client secret.

grant_type · enum<string> · requis

Must be 'authorization_code'

Options disponibles: authorization_code

code · string · requis

The authorization code received from the authorization endpoint

client_id · string · requis

Your application's Client ID

redirect_uri · string<uri> · requis

The same redirect_uri used in the authorization request. Must match exactly.

client_secret · string

Your application's Client Secret. Required for confidential clients.

audience · string

The unique identifier of the target API you want to access

client_assertion · string

A JWT signed with your client secret or private key (for Private Key JWT authentication)

client_assertion_type · enum<string>

Must be 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer' when using client_assertion

Options disponibles: urn:ietf:params:oauth:client-assertion-type:jwt-bearer

Réponse

200

application/json

Successful token exchange. Returns access token and optionally ID token and refresh token.

Successful token response containing access token and optionally ID token and refresh token

access_token · string · requis

The access token issued by the authorization server. Use this token to access protected resources (APIs).

Exemple:

"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyMzQ1In0..."

token_type · enum<string> · requis

The type of the token issued. Always 'Bearer' for Auth0.

Options disponibles: Bearer

Exemple:

"Bearer"

expires_in · integer · requis

The lifetime in seconds of the access token. After this time, the token will expire and can no longer be used.

Exemple:

86400

refresh_token · string

The refresh token which can be used to obtain new access tokens. Only returned if 'offline_access' scope was requested.

Exemple:

"v1.MRHbz1VqR_y42v..."

id_token · string

The ID Token containing user profile information. Only returned if 'openid' scope was requested. This is a JWT containing user claims.

Exemple:

"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."

scope · string

The scopes granted by the authorization server. May differ from requested scopes.

Exemple:

"openid profile email"