OAuth 2.0 Access Token Request

RapidIdentity Platform Documentation

Solution

Application

Content Type

Technical Documentation

Utilities & Services

ft:locale

en-US

The OAuth 2.0 access token request is sent by the client to the RapidIdentity token endpoint to exchange an authorization code for an access token.

Endpoint

Method: POST
Path: /idp/profile/oauth2/token
Content-Type: application/x-www-form-urlencoded

Request Parameters


Parameter	Recommendation	Description
`grant_type`	Required	Set to `authorization_code`.
`code`	Required	The authorization code returned by the authorization endpoint.
`redirect_uri`	Required	This field must match the `redirect_uri` sent in the authorization request.
`client_id`	Required	The identifier issued by RapidIdentity to the client.
`code_verifier`	Required when PKCE is in use	A cryptographically random string used to verify the `code_challenge` sent in the authorization request.

Client Authentication

Confidential clients authenticate to the token endpoint using one of the following methods. Public clients do not authenticate but must supply a code_verifier.

client_secret_basic: Client credentials are sent in an HTTP basic authentication header.
client_secret_post: Client credentials are sent in the request body as the client_id and client_secret form parameters.

Example Request

POST /idp/profile/oauth2/token HTTP/1.1
Host: rapididentity.example.com
Authorization: Basic ZXhhbXBsZS1jbGllbnQ6c2VjcmV0
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=SplxlOBeZQQYbYS6WxSbIA
&redirect_uri=https%3A%2F%2Fclient.example.com%2Fcallback
&client_id=example-client
&code_verifier=dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk