Token

Request

Retrieves tokens in various OIDC/OAuth flows. It's used to retrieve an ID token and user access token upon successful user authentication (for an authorization code flow, with or without PKCE), to complete CIBA or device authorization after the user authenticates on another device, or to retrieve client access tokens for API authorization (in a client credentials flow). It's also used to refresh an access token, to obtain a token to act on behalf of another user (delegated access), or to exchange a user token for an access token issued to another client of the same application (in a token exchange flow).

Bodyapplication/x-www-form-urlencodedrequired

One of:

client_idstringrequired

Client ID for which authentication is requested.

client_secretstringrequired

Client secret.

codestringrequired

Authorization code received from a successful authentication flow.

grant_typestringrequired

Should be set to authorization_code to identify users upon successful authentication.

Value:"authorization_code"

redirect_uristringrequired

Redirect URI passed in the authorization request.

curl -i -X POST \
  https://api.sbx.transmitsecurity.io/cis/oidc/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d client_id=string \
  -d client_secret=string \
  -d code=string \
  -d grant_type=authorization_code \
  -d redirect_uri=string

Responses

Returns user tokens

Bodyapplication/json

One of:

access_tokenstringrequired

User access token for accessing endpoints on behalf of the authenticated user.

id_tokenstringrequired

ID token that identifies the user.

expires_innumberrequired

Expiration time of the access token in seconds.

Default:3600

scopestringrequired

Scope of the access token.

token_typestringrequired

Bearer.

refresh_tokenstring

Refresh token used to refresh an expired access token. Returned only if the requested prompt includes consent and scope includes offline_access.

Response

{
  "access_token": "string",
  "id_token": "string",
  "expires_in": 3600,
  "scope": "string",
  "token_type": "string",
  "refresh_token": "string"
}