A token endpoint is an OAuth endpoint that accepts an authorization grant and issues tokens, such as an access token or ID token. It forms the server-side exchange after a user has authenticated and an authorization code has been returned. section 12.3
A typical authorization-code exchange proceeds as follows:
- Discover the endpoint from the OpenID configuration document. section 12.3
- Obtain an authorization code through the authorization endpoint. section 12.3
- Send the code, redirect URI, grant type, and client credentials to the token endpoint. section 12.3
- Receive an access token, token type, expiration, scope, and possibly an ID token. section 12.3
Exchanging an authorization code
A client posts form data to /oauth2/token with grant_type=authorization_code, the returned code, redirect_uri, and client_id, authenticating with Basic credentials. The response contains a Bearer access token with a five-minute lifetime and an ID token. section 12.3
{
"issuer": "http://localhost:9000",
"authorization_endpoint": "http://localhost:9000/oauth2/authorize", #1
"device_authorization_endpoint":
"http://localhost:9000/oauth2/device_authorization",
"token_endpoint": "http://localhost:9000/oauth2/token", #2
…
}
Inspect the OIDC configuration to find the authorization and token endpoint URLs before making requests. section 12.3
