OAuth Token

Exchanges authorization code for OpenASA-issued tokens.

Method and path

• Method: POST
• Path: /api/oauth/token
• Auth: no browser session required

Request body

JSON and form body are both supported.

• grant_type: must be authorization_code
• code
• redirect_uri
• client_id
• code_verifier

Success response

200 OK

{
  "tokenType": "Bearer",
  "accessToken": "<access_token>",
  "idToken": "<id_token>",
  "refreshToken": "<refresh_token>",
  "expiresIn": 3600,
  "scope": "openid profile email"
}

Errors

• 400:
• invalid grant_type
• invalid/expired/consumed authorization code
• invalid redirect_uri
• invalid code_verifier