OAuth 2.0

https://www.rfc-editor.org/rfc/rfc6749.txt
Admin
OAuth 2.0 is an authorization framework that enables a third-party application to obtain limited...
Tokens:29,210
Snippets:187
Trust Score:10
Update:1 week ago
Show doc for...
Tokens:
Raw
### Client Credentials Grant: Successful Response

Source: https://www.rfc-editor.org/rfc/rfc6749.txt

Example 200 OK response from the token endpoint for a valid client credentials request. Includes access_token, token_type, expires_in, and an example_parameter.

```http
HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8
Cache-Control: no-store
Pragma: no-cache

{
  "access_token":"2YotnFZFEjr1zCsicMWpAA",
  "token_type":"example",
  "expires_in":3600,
  "example_parameter":"example_value"
}
```

--------------------------------

### MAC token usage example

Source: https://www.rfc-editor.org/rfc/rfc6749.txt

Shows how to include a MAC access token in an HTTP request using the Authorization header. The token type 'mac' is defined in OAuth-HTTP-MAC and requires a MAC key and signature.

```http
GET /resource/1 HTTP/1.1
Host: example.com
Authorization: MAC id="h480djs93hd8",
                   nonce="274312:dj83hs9s",
                   mac="kDZvddkndxvhGRXZhvuDjEWhGeE="
```

--------------------------------

### HTTP Basic Authentication Header for Client Password

Source: https://www.rfc-editor.org/rfc/rfc6749.txt

Example of an Authorization header using HTTP Basic authentication with the client identifier and password encoded as per Appendix B. The header value is 'Basic czZCaGRSa3F0Mzo3RmpmcDBaQnIxS3REUmJuZlZkbUl3'.

```http
Authorization: Basic czZCaGRSa3F0Mzo3RmpmcDBaQnIxS3REUmJuZlZkbUl3
```

--------------------------------

### Bearer token usage example

Source: https://www.rfc-editor.org/rfc/rfc6749.txt

Shows how to include a bearer access token in an HTTP request using the Authorization header. The token type 'bearer' is defined in RFC 6750.

```http
GET /resource/1 HTTP/1.1
Host: example.com
Authorization: Bearer mF_9.B5f-4.1JqM
```

--------------------------------

### ABNF for type-name

Source: https://www.rfc-editor.org/rfc/rfc6749.txt

Defines the ABNF grammar for access token type names. Type names must conform to this syntax, and the token type 'example' is reserved for examples.

```abnf
type-name  = 1*name-char
name-char  = "-" / "." / "_" / DIGIT / ALPHA
```

--------------------------------

### Token Request with Client Credentials in Request Body

Source: https://www.rfc-editor.org/rfc/rfc6749.txt

Example of a POST request to the token endpoint to refresh an access token, including client credentials (client_id and client_secret) in the request body. The request uses application/x-www-form-urlencoded content type.

```http
POST /token HTTP/1.1
Host: server.example.com
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token&refresh_token=tGzv3JOkF0XG5Qx2TlKWIA
&client_id=s6BhdRkqt3&client_secret=7Fjfp0ZBr1KtDRbnfVdmIw
```

--------------------------------

### POST /token request to refresh an access token

Source: https://www.rfc-editor.org/rfc/rfc6749.txt

Example HTTP request to the token endpoint to refresh an access token. It uses the application/x-www-form-urlencoded format and includes the grant_type and refresh_token parameters. The client authenticates using HTTP Basic authentication.

```http
POST /token HTTP/1.1
Host: server.example.com
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JW
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token&refresh_token=tGzv3JOkF0XG5Qx2TlKWIA
```

--------------------------------

### POST /token (Extension Grants)

Source: https://www.rfc-editor.org/rfc/rfc6749.txt

Requests an access token using an extension grant type, such as SAML 2.0 assertion. The grant_type parameter specifies an absolute URI defined by the authorization server. The response contains the access token and optional metadata.

```APIDOC
## POST /token (Extension Grants)

### Description
Requests an access token using an extension grant type specified by an absolute URI.

### Method
POST

### Endpoint
/token

### Parameters
#### Request Body
- **grant_type** (string) - REQUIRED - Value MUST be set to an absolute URI defined by the authorization server.
- **assertion** (string) - REQUIRED - The assertion (e.g., SAML 2.0 assertion) as defined by the extension grant type.

### Request Example
```
POST /token HTTP/1.1
Host: server.example.com
Content-Type: application/x-www-form-urlencoded

grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Asaml2-bearer&assertion=PEFzc2VydGlvbiBJc3N1ZUluc3RhbnQ9IjIwMTEtMDU...
```

### Response
#### Success Response (200)
- **access_token** - REQUIRED - The access token issued by the authorization server.
- **token_type** - REQUIRED - The type of the token issued.
- **expires_in** - RECOMMENDED - The lifetime in seconds of the access token.
- **refresh_token** - OPTIONAL - The refresh token, which can be used to obtain new access tokens.
- **scope** - OPTIONAL - The scope of the access token.
```
Tokens:
Raw