/token

Request

This endpoint returns access tokens, ID tokens, and refresh tokens depending on the request parameters. For password, client credentials, SAML 2.0 assertion, and refresh token flows, calling /token is the only step of the flow. For the authorization code flow, calling /token is the second step of the flow.

Note: The /token endpoint requires client authentication. The method is configured per client app. See Client authentication methods.

Bodyapplication/x-www-form-urlencoded

grant_typestring(GrantType)

Determines the mechanism Okta uses to authorize the creation of the tokens

Enum:"authorization_code""client_credentials""implicit""interaction_code""password""refresh_token""urn:ietf:params:oauth:grant-type:device_code""urn:ietf:params:oauth:grant-type:jwt-bearer""urn:ietf:params:oauth:grant-type:saml2-bearer""urn:ietf:params:oauth:grant-type:token-exchange"

Discriminator

codestringrequired

The value is what was returned from the authorization endpoint. The code has a lifetime of 300 seconds.

code_verifierstring

Required if the code_challenge was specified in the original /authorize request. This value is the code verifier for PKCE. Okta uses it to recompute the code_challenge and verify if it matches the original code_challenge in the authorization request.

redirect_uristring

Specifies the callback location where the authorization was sent. This value must match the redirect_uri used to generate the original authorization_code.

POST

/oauth2/v1/token

curl -i -X POST \
  https://okta-subdomain.pixtulate.com/oauth2/v1/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d client_id=0jrabyQWm4B9zVJPbotY \
  -d client_secret=6W7XvLCrs4ByKn7Ucwh8ygeeXRhdGFdVOTp75eOc \
  -d grant_type=authorization_code \
  -d redirect_uri=https://www.example.com/oauth2/redirectUri \
  -d 'code=QnowT-aeawtOJKp-MtkH&'

Responses

Based on the scopes requested. The scopes specified in a request are included in the access token in the response.

Bodyapplication/json

access_tokenstring

An access token

device_secretstring

An opaque device secret. This is returned if the device_sso scope is granted.

expires_ininteger

The expiration time of the access token in seconds

id_tokenstring

An ID token. This is returned if the openid scope is granted.

refresh_tokenstring

An opaque refresh token. This is returned if the offline_access scope is granted.

scopestring

The scopes contained in the access token

token_typestring(TokenResponseTokenType)

The token type in a /token response. The value is generally Bearer except for a few instances of token exchange.

Enum:"Bearer""N_A"

issued_token_typestring(TokenTypeOrgAs)

The type of token for token exchange

Enum Value	Description
urn:ietf:params:oauth:token-type:access_token	OAuth 2.0 access token
urn:ietf:params:oauth:token-type:id_token	ID token
urn:ietf:params:oauth:token-type:jwt	JSON Web Token (JWT)
urn:ietf:params:oauth:token-type:refresh_token	OAuth 2.0 refresh token
urn:ietf:params:oauth:token-type:saml1	SAML 1.1 assertion
urn:ietf:params:oauth:token-type:saml2	SAML 2.0 assertion
urn:okta:oauth:token-type:web_sso_token	Web SSO token
urn:x-oath:params:oauth:token-type:device-secret	Device secret
urn:okta:params:oauth:token-type:interclient_token	Interclient token
urn:ietf:params:oauth:token-type:id-jag	Identity Assertion JWT Authorization Grant (ID-JAG). This type is only available with Cross App Access or if you're subscribed to Okta for AI Agents.
urn:okta:params:oauth:token-type:vaulted-secret	OPA vaulted secret. This type is only available if you're subscribed to Okta for AI Agents.
urn:okta:params:oauth:token-type:service-account	OPA service account. This type is only available if you're subscribed to Okta for AI Agents.
urn:okta:params:oauth:token-type:oauth-sts	OAuth Security Token Service (STS). This type is only available if you're subscribed to Okta for AI Agents.

service_accountobject(TokenResponseServiceAccount)

The service account credentials. This is returned if the issued_token_type is urn:okta:params:oauth:token-type:service-account.

Note: This is only available if you're subscribed to Okta for AI Agents. Contact Okta Support for more information.

vaulted_secretobject(TokenResponseVaultedSecret)

The vaulted secret containing key-value pairs. This is returned if the issued_token_type is urn:okta:params:oauth:token-type:vaulted-secret.

Note: This is only available if you're subscribed to Okta for AI Agents. Contact Okta Support for more information.

Response

{
  "access_token": "<access_token_value>",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "openid email offline_access",
  "refresh_token": "a9VpZDRCeFh3Nkk2VdY",
  "id_token": "<id_token_example>"
}