A token endpoint lets a client exchange an authorization code for tokens after successful user authentication. The client sends an HTTP POST request and authenticates with HTTP Basic when that method was registered. section 14.2
A successful authorization-code request includes:
- client_id identifying the client. section 14.2
- redirect_uri matching the URI used during authorization. section 14.2
- grant_type=authorization_code, the authorization code, and the code verifier. section 14.2
- Values must match the registered client and earlier authorization request or the exchange fails. section 14.2
Request and response
POST http://localhost:8080/oauth2/token with the authorization code parameters and an HTTP Basic client credential produces an access token. With OpenID Connect enabled, the response also includes an ID token; refresh-token registration can add a refresh token. section 14.2
Listing 14.7 The response of the OpenID configuration request
{
"issuer": "http://localhost:8080",
"authorization_endpoint":
"http://localhost:8080/oauth2/authorize", #1
"token_endpoint": "http://localhost:8080/oauth2/token", #2
"token_endpoint_auth_methods_supported": [
"client_secret_basic",
"client_secret_post",
"client_secret_jwt",
"private_key_jwt"
],
"jwks_uri": "http://localhost:8080/oauth2/jwks", #3
"userinfo_endpoint": "http://localhost:8080/userinfo",
"response_types_supported": [
"code"
],
"grant_types_supported": [
"authorization_code",
"client_credentials",
"refresh_token"
],
"revocation_endpoint": "http://localhost:8080/oauth2/revoke",
"revocation_endpoint_auth_methods_supported": [
"client_secret_basic",
"client_secret_post",
"client_secret_jwt",
"private_key_jwt"
],
"introspection_endpoint":
"http://localhost:8080/oauth2/introspect", #4
"introspection_endpoint_auth_methods_supported": [
"client_secret_basic",
"client_secret_post",
"client_secret_jwt",
"private_key_jwt"
],
"subject_types_supported": [
"public"
],
"id_token_signing_alg_values_supported": [
"RS256"
],
"scopes_supported": [
"openid"
]
}
The OpenID configuration document advertises the token endpoint, supported client-authentication methods, and supported grant types. section 14.2
