跳转到主要内容
POST
POST /v1/oauth/token

请求体

RFC 6749 §4.1.3 / §6 and RFC 8628 §3.4, in one shape.

Which fields must be present depends on grant_type, so all of them are optional here and the issuer names what is missing. That is deliberate: a client that sends code with grant_type=refresh_token deserves invalid_request: refresh_token is required, not a parse error listing every field of every grant type.

client_id
string
默认值:""

Required for every grant type. These are public clients — there is no client secret to authenticate with — so this names the client and is checked against the grant, never trusted on its own.

code
string | null
code_verifier
string | null
device_code
string | null
grant_type
string
默认值:""

authorization_code, refresh_token or [DEVICE_GRANT_TYPE].

redirect_uri
string | null
refresh_token
string | null

响应

Success

RFC 6749 §5.1. Both token values are plaintext and exist only here.

access_token
string
必填
expires_in
integer<int64>
必填

The access token's remaining lifetime, in seconds.

refresh_token
string
必填

Rotated on every exchange: the one presented is consumed and this one replaces it. Presenting a consumed refresh token revokes the whole grant — see [crate::operations::issuer].

scope
string
必填

The granted scopes, space-delimited, as they are recorded on the grant.

token_type
string
必填

Always [TOKEN_TYPE].