Exchange or refresh an access token

POST

/api/v1/auth/token

curl --request POST \
  --url https://localhost:8080/api/v1/auth/token \
  --header 'Content-Type: application/json' \
  --data '{ "grant_type": "urn:ietf:params:oauth:grant-type:token-exchange", "refresh_token": "example", "subject_token": "example", "subject_token_type": "urn:ietf:params:oauth:token-type:access_token" }'

Issue an enriched access token (and rotated refresh token) via OAuth 2.0 Token Exchange (RFC 8693) or refresh-token grant; also mounted at /api/v1/auth/token-exchange for backward compatibility

Request Body

Token request

Media type application/json

object

grant_type

required

string

Allowed values: urn:ietf:params:oauth:grant-type:token-exchange refresh_token

refresh_token

Required for the refresh_token grant

string

subject_token

Required for the token-exchange grant

string

subject_token_type

Token-exchange grant; access_token only

string

Allowed values: urn:ietf:params:oauth:token-type:access_token

Responses

200

Token response

Media type application/json

An OAuth token response, returned by both the exchange and refresh grants

object

access_token

string

expires_in

Access token lifetime in seconds

integer

issued_token_type

string

refresh_expires_in

Refresh token lifetime in seconds

integer

refresh_token

string

scope

string

token_type

string

Example ^generated

{
  "access_token": "example",
  "expires_in": 1,
  "issued_token_type": "example",
  "refresh_expires_in": 1,
  "refresh_token": "example",
  "scope": "example",
  "token_type": "example"
}

400

Invalid request

Media type application/json

Error body returned across the auth endpoints; the message is human-readable and not a stable identifier

object

error

string

error_description

string

Example

{
  "error": "Unauthorized",
  "error_description": "Invalid token"
}

401

Invalid or expired token

Media type application/json

Error body returned across the auth endpoints; the message is human-readable and not a stable identifier

object

error

string

error_description

string

Example

{
  "error": "Unauthorized",
  "error_description": "Invalid token"
}

500

Internal server error

Media type application/json

Error body returned across the auth endpoints; the message is human-readable and not a stable identifier

object

error

string

error_description

string

Example

{
  "error": "Unauthorized",
  "error_description": "Invalid token"
}