Token Endpoint

The token endpoint can be used to programmatically request tokens. It supports the password, authorization_code, client_credentials, refresh_token and urn:ietf:params:oauth:grant-type:device_code grant types. Furthermore the token endpoint can be extended to support extension grant types.

Note

IdentityServer supports a subset of the OpenID Connect and OAuth 2.0 token request parameters. For a full list, see here.

client_id

client identifier (required – Either in the body or as part of the authorization header.)

client_secret

client secret either in the post body, or as a basic authentication header. Optional.

grant_type

authorization_code, client_credentials, password, refresh_token, urn:ietf:params:oauth:grant-type:device_code or custom

scope

one or more registered scopes. If not specified, a token for all explicitly allowed scopes will be issued.

redirect_uri

required for the authorization_code grant type

code

the authorization code (required for authorization_code grant type)

code_verifier

PKCE proof key

username

resource owner username (required for password grant type)

password

resource owner password (required for password grant type)

acr_values

allows passing in additional authentication related information for the password grant type - identityserver special cases the following proprietary acr_values:

idp:name_of_idp bypasses the login/home realm screen and forwards the user directly to the selected identity provider (if allowed per client configuration)

tenant:name_of_tenant can be used to pass a tenant name to the token endpoint

refresh_token

the refresh token (required for refresh_token grant type)

device_code

the device code (required for urn:ietf:params:oauth:grant-type:device_code grant type)

Example

POST /connect/token
CONTENT-TYPE application/x-www-form-urlencoded

    client_id=client1&
    client_secret=secret&
    grant_type=authorization_code&
    code=hdh922&
    redirect_uri=https://myapp.com/callback

(Form-encoding removed and line breaks added for readability)

Note

You can use the IdentityModel client library to programmatically access the token endpoint from .NET code. For more information check the IdentityModel docs.