OAuth (API) | Accountmaker 文档

OAuth2 authorization

GET/oauth2/authorize

OAuth2 authorization endpoint for the Authorization Code Flow with PKCE.

Use this to:

Show login/register UI
Handle seamless sign-in
Redirect with authorization code

Flow:

Client → /oauth/authorize (this endpoint)
User logs in → redirect to redirect_uri with code
Client → /oauth/token → access token

Tip: Use prompt=none + seamless sign-in for silent auth.

Responses

302text/plain

Redirect to client with `code` or error

schema

defaultapplication/jsonOAuth2Error

Standard OAuth 2.0 / OpenID Connect error response. Used by: token endpoint, introspection, revocation, device authorization, etc.

schemaOAuth2Error

errorstringrequired

The error code as defined in RFC 6749 §5.2 and extensions.

error_descriptionstring

Human-readable text providing additional information.

error_uristring · uri

A URI identifying a human-readable web page with information about the error.

curl -X GET \\
  "${BASE_URL}/oauth2/authorize?response_type=code&client_id=cid789&redirect_uri=string&state=string&code_challenge=string&code_challenge_method=S256&prompt=login&error=string&login_hint=string&scope=string&audience=string&connection=string&invitation=string&response_mode=fragment" \\
  -H "Authorization: Bearer ${API_TOKEN}"

const url = "${BASE_URL}/oauth2/authorize?response_type=code&client_id=cid789&redirect_uri=string&state=string&code_challenge=string&code_challenge_method=S256&prompt=login&error=string&login_hint=string&scope=string&audience=string&connection=string&invitation=string&response_mode=fragment";
const response = await fetch(url, {
  method: "GET",
  headers: {
    "Authorization": "Bearer ${API_TOKEN}",
  },
});

console.log(await response.json());

const url = "${BASE_URL}/oauth2/authorize?response_type=code&client_id=cid789&redirect_uri=string&state=string&code_challenge=string&code_challenge_method=S256&prompt=login&error=string&login_hint=string&scope=string&audience=string&connection=string&invitation=string&response_mode=fragment";
const response = await fetch(url, {
  method: "GET",
  headers: {
    "Authorization": "Bearer ${API_TOKEN}",
  },
} as RequestInit);

console.log(await response.json());

const response = await axios({
  method: "get",
  url: "${BASE_URL}/oauth2/authorize?response_type=code&client_id=cid789&redirect_uri=string&state=string&code_challenge=string&code_challenge_method=S256&prompt=login&error=string&login_hint=string&scope=string&audience=string&connection=string&invitation=string&response_mode=fragment",
  headers: {
    Authorization: "Bearer ${API_TOKEN}",
  },
});

console.log(response.data);

const response: AxiosResponse = await axios({
  method: "get",
  url: "${BASE_URL}/oauth2/authorize?response_type=code&client_id=cid789&redirect_uri=string&state=string&code_challenge=string&code_challenge_method=S256&prompt=login&error=string&login_hint=string&scope=string&audience=string&connection=string&invitation=string&response_mode=fragment",
  headers: {
    Authorization: "Bearer ${API_TOKEN}",
  },
});

console.log(response.data);

import { request } from "undici";

const { body } = await request("${BASE_URL}/oauth2/authorize?response_type=code&client_id=cid789&redirect_uri=string&state=string&code_challenge=string&code_challenge_method=S256&prompt=login&error=string&login_hint=string&scope=string&audience=string&connection=string&invitation=string&response_mode=fragment", {
  method: "GET",
  headers: {
    Authorization: "Bearer ${API_TOKEN}",
  },
});

console.log(await body.json());

import requests

payload = None
response = requests.request( \
    "GET", \
    "${BASE_URL}/oauth2/authorize?response_type=code&client_id=cid789&redirect_uri=string&state=string&code_challenge=string&code_challenge_method=S256&prompt=login&error=string&login_hint=string&scope=string&audience=string&connection=string&invitation=string&response_mode=fragment", \
    headers={"Authorization": "Bearer ${API_TOKEN}"}, \
    json=payload,
)
print(response.json())

import httpx

payload = None
with httpx.Client() as client:
    response = client.request( \
        "GET", \
        "${BASE_URL}/oauth2/authorize?response_type=code&client_id=cid789&redirect_uri=string&state=string&code_challenge=string&code_challenge_method=S256&prompt=login&error=string&login_hint=string&scope=string&audience=string&connection=string&invitation=string&response_mode=fragment", \
        headers={"Authorization": "Bearer ${API_TOKEN}"}, \
        json=payload,
    )
print(response.json())

payload := http.NoBody

req, err := http.NewRequest("GET", "${BASE_URL}/oauth2/authorize?response_type=code&client_id=cid789&redirect_uri=string&state=string&code_challenge=string&code_challenge_method=S256&prompt=login&error=string&login_hint=string&scope=string&audience=string&connection=string&invitation=string&response_mode=fragment", payload)
if err != nil {
  panic(err)
}
req.Header.Set("Authorization", "Bearer ${API_TOKEN}")
if payload != http.NoBody {
  req.Header.Set("Content-Type", "application/json")
}

res, err := (&http.Client{}).Do(req)
if err != nil {
  panic(err)
}
defer res.Body.Close()

require "json"
require "net/http"

payload = nil
uri = URI("${BASE_URL}/oauth2/authorize?response_type=code&client_id=cid789&redirect_uri=string&state=string&code_challenge=string&code_challenge_method=S256&prompt=login&error=string&login_hint=string&scope=string&audience=string&connection=string&invitation=string&response_mode=fragment")
request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer ${API_TOKEN}"
request["Content-Type"] = "application/json"
response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| \
  http.request(request) \
}
puts response.body

<?php

use GuzzleHttp\Client;

$payload = null;
$client = new Client();
$response = $client->request("GET", "${BASE_URL}/oauth2/authorize?response_type=code&client_id=cid789&redirect_uri=string&state=string&code_challenge=string&code_challenge_method=S256&prompt=login&error=string&login_hint=string&scope=string&audience=string&connection=string&invitation=string&response_mode=fragment", [
  'headers' => [
    'Authorization' => 'Bearer ${API_TOKEN}',
  ],
]);

echo $response->getBody();

using System.Net.Http;
using System.Text;

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Get, "${BASE_URL}/oauth2/authorize?response_type=code&client_id=cid789&redirect_uri=string&state=string&code_challenge=string&code_challenge_method=S256&prompt=login&error=string&login_hint=string&scope=string&audience=string&connection=string&invitation=string&response_mode=fragment");
request.Headers.Add("Authorization", "Bearer ${API_TOKEN}");
var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST/oauth2/device_authorization

Request device and user codes for the device authorization flow (RFC 8628). The device displays the user_code and directs the user to verification_uri. More

Body application/json

client_idstring

Unique identifier for a client application.

client_secretstring

scopestring

audiencestring

Responses

200application/json

Device authorization initiated successfully

schemaobject

device_codestringrequired

user_codestringrequired

verification_uristringrequired

verification_uri_completestringrequired

expires_innumberrequired

intervalnumberrequired

defaultapplication/jsonOAuth2Error

Standard OAuth 2.0 / OpenID Connect error response. Used by: token endpoint, introspection, revocation, device authorization, etc.

schemaOAuth2Error

errorstringrequired

The error code as defined in RFC 6749 §5.2 and extensions.

error_descriptionstring

Human-readable text providing additional information.

error_uristring · uri

A URI identifying a human-readable web page with information about the error.

curl -X POST \\
  "${BASE_URL}/oauth2/device_authorization" \\
  -H "Authorization: Bearer ${API_TOKEN}" \\
  -H "Content-Type: application/json" \\
  -d '{"client_id":"cid789","client_secret":"string","scope":"string","audience":"string"}'

const payload = {"client_id":"cid789","client_secret":"string","scope":"string","audience":"string"};
const url = "${BASE_URL}/oauth2/device_authorization";
const response = await fetch(url, {
  method: "POST",
  headers: {
    "Authorization": "Bearer ${API_TOKEN}",
    "Content-Type": "application/json",
  },
  body: JSON.stringify(payload),
});

console.log(await response.json());

const payload = {"client_id":"cid789","client_secret":"string","scope":"string","audience":"string"};
const url = "${BASE_URL}/oauth2/device_authorization";
const response = await fetch(url, {
  method: "POST",
  headers: {
    "Authorization": "Bearer ${API_TOKEN}",
    "Content-Type": "application/json",
  },
  body: JSON.stringify(payload),
} as RequestInit);

console.log(await response.json());

const payload = {"client_id":"cid789","client_secret":"string","scope":"string","audience":"string"};
const response = await axios({
  method: "post",
  url: "${BASE_URL}/oauth2/device_authorization",
  headers: {
    Authorization: "Bearer ${API_TOKEN}",
    "Content-Type": "application/json",
  },
  data: payload,
});

console.log(response.data);

const payload = {"client_id":"cid789","client_secret":"string","scope":"string","audience":"string"};
const response: AxiosResponse = await axios({
  method: "post",
  url: "${BASE_URL}/oauth2/device_authorization",
  headers: {
    Authorization: "Bearer ${API_TOKEN}",
    "Content-Type": "application/json",
  },
  data: payload,
});

console.log(response.data);

import { request } from "undici";

const bodyData = {"client_id":"cid789","client_secret":"string","scope":"string","audience":"string"};
const { body } = await request("${BASE_URL}/oauth2/device_authorization", {
  method: "POST",
  headers: {
    Authorization: "Bearer ${API_TOKEN}",
      "Content-Type": "application/json",
  },
    body: JSON.stringify(bodyData),
});

console.log(await body.json());

import requests

payload = {"client_id":"cid789","client_secret":"string","scope":"string","audience":"string"}
response = requests.request( \
    "POST", \
    "${BASE_URL}/oauth2/device_authorization", \
    headers={"Authorization": "Bearer ${API_TOKEN}"}, \
    json=payload,
)
print(response.json())

import httpx

payload = {"client_id":"cid789","client_secret":"string","scope":"string","audience":"string"}
with httpx.Client() as client:
    response = client.request( \
        "POST", \
        "${BASE_URL}/oauth2/device_authorization", \
        headers={"Authorization": "Bearer ${API_TOKEN}"}, \
        json=payload,
    )
print(response.json())

payload := bytes.NewBuffer([]byte(`{"client_id":"cid789","client_secret":"string","scope":"string","audience":"string"}`))

req, err := http.NewRequest("POST", "${BASE_URL}/oauth2/device_authorization", payload)
if err != nil {
  panic(err)
}
req.Header.Set("Authorization", "Bearer ${API_TOKEN}")
if payload != http.NoBody {
  req.Header.Set("Content-Type", "application/json")
}

res, err := (&http.Client{}).Do(req)
if err != nil {
  panic(err)
}
defer res.Body.Close()

require "json"
require "net/http"

payload = {"client_id":"cid789","client_secret":"string","scope":"string","audience":"string"}
uri = URI("${BASE_URL}/oauth2/device_authorization")
request = Net::HTTP::Post.new(uri)
request["Authorization"] = "Bearer ${API_TOKEN}"
request["Content-Type"] = "application/json"
request.body = payload.to_json
response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| \
  http.request(request) \
}
puts response.body

<?php

use GuzzleHttp\Client;

$payload = {"client_id":"cid789","client_secret":"string","scope":"string","audience":"string"};
$client = new Client();
$response = $client->request("POST", "${BASE_URL}/oauth2/device_authorization", [
  'headers' => [
    'Authorization' => 'Bearer ${API_TOKEN}',
  ],
  'json' => $payload,
]);

echo $response->getBody();

using System.Net.Http;
using System.Text;

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Post, "${BASE_URL}/oauth2/device_authorization");
request.Headers.Add("Authorization", "Bearer ${API_TOKEN}");
request.Content = new StringContent("{\"client_id\":\"cid789\",\"client_secret\":\"string\",\"scope\":\"string\",\"audience\":\"string\"}", Encoding.UTF8, "application/json");
var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST/oauth2/introspect

Introspect an access token or refresh token.

Since refresh tokens are opaque, they can only be introspected with this endpoint.

This endpoint is primarily used for:

Building admin dashboards (“Active Sessions” page)
Implementing “Sign out everywhere” / per-device revocation
Auditing active tokens for compliance
Supporting legacy or gateway-based architectures

Ideally, resource servers should validate access tokens locally using the public JWKS endpoint (/.well-known/jwks.json) instead of this endpoint.

Clients with client_secret configured must provide client_secret. Client ID is optional when resolving by hostname.

Body application/json

tokenstringrequired

token_type_hint

client_idstring

Unique identifier for a client application.

client_secretstring

Responses

200application/json

Token introspection response.

schemaobject

Variant

Option 1object

activerequired

Option 2object

activerequired

token_typerequired

client_idstringrequired

Unique identifier for a client application.

substringrequired

Variant

Unique identifier for a user.

Option 1string

Unique identifier for a user.

Unique identifier for a client application.

Option 2string

Unique identifier for a client application.

issstringrequired

appstringrequired

Unique identifier for an application.

accstring

Unique identifier for an account.

uidstring

Unique identifier for a user.

cidstringrequired

Unique identifier for a client application.

audstringrequired

iatnumberrequired

expnumberrequired

scopestringrequired

rolestring

kidstring

jtistring

actobject

defaultapplication/problem+jsonProblemDetails

HTTP Error

schemaProblemDetails

typestring · urirequired

titlestringrequired

statusintegerrequired

detailstring

instancestring · uri

codestring

curl -X POST \\
  "${BASE_URL}/oauth2/introspect" \\
  -H "Authorization: Bearer ${API_TOKEN}" \\
  -H "Content-Type: application/json" \\
  -d '{"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"}'

const payload = {"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"};
const url = "${BASE_URL}/oauth2/introspect";
const response = await fetch(url, {
  method: "POST",
  headers: {
    "Authorization": "Bearer ${API_TOKEN}",
    "Content-Type": "application/json",
  },
  body: JSON.stringify(payload),
});

console.log(await response.json());

const payload = {"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"};
const url = "${BASE_URL}/oauth2/introspect";
const response = await fetch(url, {
  method: "POST",
  headers: {
    "Authorization": "Bearer ${API_TOKEN}",
    "Content-Type": "application/json",
  },
  body: JSON.stringify(payload),
} as RequestInit);

console.log(await response.json());

const payload = {"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"};
const response = await axios({
  method: "post",
  url: "${BASE_URL}/oauth2/introspect",
  headers: {
    Authorization: "Bearer ${API_TOKEN}",
    "Content-Type": "application/json",
  },
  data: payload,
});

console.log(response.data);

const payload = {"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"};
const response: AxiosResponse = await axios({
  method: "post",
  url: "${BASE_URL}/oauth2/introspect",
  headers: {
    Authorization: "Bearer ${API_TOKEN}",
    "Content-Type": "application/json",
  },
  data: payload,
});

console.log(response.data);

import { request } from "undici";

const bodyData = {"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"};
const { body } = await request("${BASE_URL}/oauth2/introspect", {
  method: "POST",
  headers: {
    Authorization: "Bearer ${API_TOKEN}",
      "Content-Type": "application/json",
  },
    body: JSON.stringify(bodyData),
});

console.log(await body.json());

import requests

payload = {"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"}
response = requests.request( \
    "POST", \
    "${BASE_URL}/oauth2/introspect", \
    headers={"Authorization": "Bearer ${API_TOKEN}"}, \
    json=payload,
)
print(response.json())

import httpx

payload = {"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"}
with httpx.Client() as client:
    response = client.request( \
        "POST", \
        "${BASE_URL}/oauth2/introspect", \
        headers={"Authorization": "Bearer ${API_TOKEN}"}, \
        json=payload,
    )
print(response.json())

payload := bytes.NewBuffer([]byte(`{"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"}`))

req, err := http.NewRequest("POST", "${BASE_URL}/oauth2/introspect", payload)
if err != nil {
  panic(err)
}
req.Header.Set("Authorization", "Bearer ${API_TOKEN}")
if payload != http.NoBody {
  req.Header.Set("Content-Type", "application/json")
}

res, err := (&http.Client{}).Do(req)
if err != nil {
  panic(err)
}
defer res.Body.Close()

require "json"
require "net/http"

payload = {"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"}
uri = URI("${BASE_URL}/oauth2/introspect")
request = Net::HTTP::Post.new(uri)
request["Authorization"] = "Bearer ${API_TOKEN}"
request["Content-Type"] = "application/json"
request.body = payload.to_json
response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| \
  http.request(request) \
}
puts response.body

<?php

use GuzzleHttp\Client;

$payload = {"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"};
$client = new Client();
$response = $client->request("POST", "${BASE_URL}/oauth2/introspect", [
  'headers' => [
    'Authorization' => 'Bearer ${API_TOKEN}',
  ],
  'json' => $payload,
]);

echo $response->getBody();

using System.Net.Http;
using System.Text;

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Post, "${BASE_URL}/oauth2/introspect");
request.Headers.Add("Authorization", "Bearer ${API_TOKEN}");
request.Content = new StringContent("{\"token\":\"string\",\"token_type_hint\":\"access_token\",\"client_id\":\"cid789\",\"client_secret\":\"string\"}", Encoding.UTF8, "application/json");
var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST/oauth2/revoke

Revoke an OAuth2 token (RFC 7009). Use in logout flows to invalidate tokens. Refresh tokens are revoked immediately; access tokens (JWTs) cannot be server-side invalidated but are acknowledged. Per RFC 7009, always returns 200 OK. More

Body application/json

tokenstringrequired

token_type_hint

client_idstring

Unique identifier for a client application.

client_secretstring

Responses

200application/json

Token revoked successfully

schemaobject

defaultapplication/jsonOAuth2Error

Standard OAuth 2.0 / OpenID Connect error response. Used by: token endpoint, introspection, revocation, device authorization, etc.

schemaOAuth2Error

errorstringrequired

The error code as defined in RFC 6749 §5.2 and extensions.

error_descriptionstring

Human-readable text providing additional information.

error_uristring · uri

A URI identifying a human-readable web page with information about the error.

curl -X POST \\
  "${BASE_URL}/oauth2/revoke" \\
  -H "Authorization: Bearer ${API_TOKEN}" \\
  -H "Content-Type: application/json" \\
  -d '{"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"}'

const payload = {"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"};
const url = "${BASE_URL}/oauth2/revoke";
const response = await fetch(url, {
  method: "POST",
  headers: {
    "Authorization": "Bearer ${API_TOKEN}",
    "Content-Type": "application/json",
  },
  body: JSON.stringify(payload),
});

console.log(await response.json());

const payload = {"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"};
const url = "${BASE_URL}/oauth2/revoke";
const response = await fetch(url, {
  method: "POST",
  headers: {
    "Authorization": "Bearer ${API_TOKEN}",
    "Content-Type": "application/json",
  },
  body: JSON.stringify(payload),
} as RequestInit);

console.log(await response.json());

const payload = {"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"};
const response = await axios({
  method: "post",
  url: "${BASE_URL}/oauth2/revoke",
  headers: {
    Authorization: "Bearer ${API_TOKEN}",
    "Content-Type": "application/json",
  },
  data: payload,
});

console.log(response.data);

const payload = {"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"};
const response: AxiosResponse = await axios({
  method: "post",
  url: "${BASE_URL}/oauth2/revoke",
  headers: {
    Authorization: "Bearer ${API_TOKEN}",
    "Content-Type": "application/json",
  },
  data: payload,
});

console.log(response.data);

import { request } from "undici";

const bodyData = {"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"};
const { body } = await request("${BASE_URL}/oauth2/revoke", {
  method: "POST",
  headers: {
    Authorization: "Bearer ${API_TOKEN}",
      "Content-Type": "application/json",
  },
    body: JSON.stringify(bodyData),
});

console.log(await body.json());

import requests

payload = {"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"}
response = requests.request( \
    "POST", \
    "${BASE_URL}/oauth2/revoke", \
    headers={"Authorization": "Bearer ${API_TOKEN}"}, \
    json=payload,
)
print(response.json())

import httpx

payload = {"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"}
with httpx.Client() as client:
    response = client.request( \
        "POST", \
        "${BASE_URL}/oauth2/revoke", \
        headers={"Authorization": "Bearer ${API_TOKEN}"}, \
        json=payload,
    )
print(response.json())

payload := bytes.NewBuffer([]byte(`{"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"}`))

req, err := http.NewRequest("POST", "${BASE_URL}/oauth2/revoke", payload)
if err != nil {
  panic(err)
}
req.Header.Set("Authorization", "Bearer ${API_TOKEN}")
if payload != http.NoBody {
  req.Header.Set("Content-Type", "application/json")
}

res, err := (&http.Client{}).Do(req)
if err != nil {
  panic(err)
}
defer res.Body.Close()

require "json"
require "net/http"

payload = {"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"}
uri = URI("${BASE_URL}/oauth2/revoke")
request = Net::HTTP::Post.new(uri)
request["Authorization"] = "Bearer ${API_TOKEN}"
request["Content-Type"] = "application/json"
request.body = payload.to_json
response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| \
  http.request(request) \
}
puts response.body

<?php

use GuzzleHttp\Client;

$payload = {"token":"string","token_type_hint":"access_token","client_id":"cid789","client_secret":"string"};
$client = new Client();
$response = $client->request("POST", "${BASE_URL}/oauth2/revoke", [
  'headers' => [
    'Authorization' => 'Bearer ${API_TOKEN}',
  ],
  'json' => $payload,
]);

echo $response->getBody();

using System.Net.Http;
using System.Text;

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Post, "${BASE_URL}/oauth2/revoke");
request.Headers.Add("Authorization", "Bearer ${API_TOKEN}");
request.Content = new StringContent("{\"token\":\"string\",\"token_type_hint\":\"access_token\",\"client_id\":\"cid789\",\"client_secret\":\"string\"}", Encoding.UTF8, "application/json");
var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

POST/oauth2/token

POST endpoint to get an access token.

Supports multiple OAuth2 types:

Grant Type	Use Case
`authorization_code`	Authorization code flow (PKCE). Most secure and common.
`client_credentials`	Machine-to-machine auth using shared secret / API key. No user. Meant for IoT, sensors, CI/CD or infrastructure.
`urn:ietf:params:oauth:grant-type:device_code`	Device Code Exchange. Device presents a code, user enters code in browser or phone.
`urn:ietf:params:oauth:grant-type:jwt-bearer`	JWT Exchange. Public/private asymmetric shared secrets.
`urn:ietf:params:oauth:grant-type:saml2-bearer`	SAML2. Common for Enterprise SSO.
`urn:ietf:params:oauth:grant-type:token-exchange`	Use current access_token to get more specific token to access resources of a particular membership or different audience.
`refresh_token`	Refresh an access token, same as /oauth/refresh
`password`	Legacy username/password (disabled by default)

Security:

Public clients → client_secret optional
Confidential clients → client_secret required
client_id is optional when resolving by hostname

See: RFC 6749

Body application/json

bodyobject

Variant

Option 1object

grant_typerequired

codestringrequired

client_idstring

Unique identifier for a client application.

client_secretstring

redirect_uristringrequired

code_verifierstring

Option 2object

grant_typerequired

refresh_tokenstringrequired

client_idstring

Unique identifier for a client application.

client_secretstring

Option 3object

grant_typerequired

usernamestringrequired

passwordstringrequired

client_idstring

Unique identifier for a client application.

client_secretstring

scopestring

A space-separated list of scopes. An empty string means no scopes.

audiencestring

The intended audience.

Option 4object

grant_typerequired

client_idstring

Unique identifier for a client application.

client_secretstringrequired

scopestring

A space-separated list of scopes. An empty string means no scopes.

audiencestring

The intended audience.

Option 5object

grant_typerequired

device_codestringrequired

client_idstring

Unique identifier for a client application.

client_secretstring

scopestring

A space-separated list of scopes. An empty string means no scopes.

audiencestring

The intended audience.

Option 6object

grant_typerequired

assertionstringrequired

client_idstring

Unique identifier for a client application.

client_secretstring

scopestring

A space-separated list of scopes. An empty string means no scopes.

audiencestring

The intended audience.

Option 7object

grant_typerequired

assertionstringrequired

client_idstring

Unique identifier for a client application.

client_secretstring

scopestring

A space-separated list of scopes. An empty string means no scopes.

audiencestring

The intended audience.

Option 8object

grant_typerequired

client_idstring

Unique identifier for a client application.

client_secretstring

subject_tokenstringrequired

A JWT containing sub, iss, aud claims. In most cases, pass in the same access token as the Authentication header. It will be validated and exchanged for a different token based on the requested audience, scope, and resource.

subject_token_typerequired

The type of the subject token.

requested_token_type

The type of token being requested.

audiencestring

The intended audience.

scopestring

A space-separated list of scopes. An empty string means no scopes.

resourcestring · uri

The resource for which the token is being requested.

actor_tokenstring

Used in situations where you want a backend service to combine its token with a user's token to access a resource. It guarantees that both the actor and subject have been authorized to access the resource.

actor_token_type

The type of the actor token.

Responses

200application/jsonSessionTokens

Successful token response

schemaSessionTokens

The set of tokens issued to a client upon successful authentication or token refresh

access_tokenAccessTokenrequired

A short-lived JWT access token signed by the authentication service

refresh_tokenRefreshTokenrequired

An opaque long-lived refresh token used to obtain new access tokens. Can be revoked.

token_typeTokenTyperequired

Description of how the access token should be used

expires_inTimestampInSecondsrequired

A Unix timestamp in seconds since the epoch

defaultapplication/jsonOAuth2Error

Standard OAuth 2.0 / OpenID Connect error response. Used by: token endpoint, introspection, revocation, device authorization, etc.

schemaOAuth2Error

errorstringrequired

The error code as defined in RFC 6749 §5.2 and extensions.

error_descriptionstring

Human-readable text providing additional information.

error_uristring · uri

A URI identifying a human-readable web page with information about the error.

curl -X POST \\
  "${BASE_URL}/oauth2/token" \\
  -H "Authorization: Bearer ${API_TOKEN}" \\
  -H "Content-Type: application/json" \\
  -d '"value"'

const payload = "value";
const url = "${BASE_URL}/oauth2/token";
const response = await fetch(url, {
  method: "POST",
  headers: {
    "Authorization": "Bearer ${API_TOKEN}",
    "Content-Type": "application/json",
  },
  body: JSON.stringify(payload),
});

console.log(await response.json());

const payload = "value";
const url = "${BASE_URL}/oauth2/token";
const response = await fetch(url, {
  method: "POST",
  headers: {
    "Authorization": "Bearer ${API_TOKEN}",
    "Content-Type": "application/json",
  },
  body: JSON.stringify(payload),
} as RequestInit);

console.log(await response.json());

const payload = "value";
const response = await axios({
  method: "post",
  url: "${BASE_URL}/oauth2/token",
  headers: {
    Authorization: "Bearer ${API_TOKEN}",
    "Content-Type": "application/json",
  },
  data: payload,
});

console.log(response.data);

const payload = "value";
const response: AxiosResponse = await axios({
  method: "post",
  url: "${BASE_URL}/oauth2/token",
  headers: {
    Authorization: "Bearer ${API_TOKEN}",
    "Content-Type": "application/json",
  },
  data: payload,
});

console.log(response.data);

import { request } from "undici";

const bodyData = "value";
const { body } = await request("${BASE_URL}/oauth2/token", {
  method: "POST",
  headers: {
    Authorization: "Bearer ${API_TOKEN}",
      "Content-Type": "application/json",
  },
    body: JSON.stringify(bodyData),
});

console.log(await body.json());

import requests

payload = "value"
response = requests.request( \
    "POST", \
    "${BASE_URL}/oauth2/token", \
    headers={"Authorization": "Bearer ${API_TOKEN}"}, \
    json=payload,
)
print(response.json())

import httpx

payload = "value"
with httpx.Client() as client:
    response = client.request( \
        "POST", \
        "${BASE_URL}/oauth2/token", \
        headers={"Authorization": "Bearer ${API_TOKEN}"}, \
        json=payload,
    )
print(response.json())

payload := bytes.NewBuffer([]byte(`"value"`))

req, err := http.NewRequest("POST", "${BASE_URL}/oauth2/token", payload)
if err != nil {
  panic(err)
}
req.Header.Set("Authorization", "Bearer ${API_TOKEN}")
if payload != http.NoBody {
  req.Header.Set("Content-Type", "application/json")
}

res, err := (&http.Client{}).Do(req)
if err != nil {
  panic(err)
}
defer res.Body.Close()

require "json"
require "net/http"

payload = "value"
uri = URI("${BASE_URL}/oauth2/token")
request = Net::HTTP::Post.new(uri)
request["Authorization"] = "Bearer ${API_TOKEN}"
request["Content-Type"] = "application/json"
request.body = payload.to_json
response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| \
  http.request(request) \
}
puts response.body

<?php

use GuzzleHttp\Client;

$payload = "value";
$client = new Client();
$response = $client->request("POST", "${BASE_URL}/oauth2/token", [
  'headers' => [
    'Authorization' => 'Bearer ${API_TOKEN}',
  ],
  'json' => $payload,
]);

echo $response->getBody();

using System.Net.Http;
using System.Text;

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Post, "${BASE_URL}/oauth2/token");
request.Headers.Add("Authorization", "Bearer ${API_TOKEN}");
request.Content = new StringContent("\"value\"", Encoding.UTF8, "application/json");
var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

GET/oauth2/userinfo

Returns claims about the authenticated user.

This is a standard OpenID Connect UserInfo endpoint (RFC 7662) that allows clients to retrieve user information after authentication using a valid access token.

The claims returned depend on the scopes granted in the access token:

openid: Required for OIDC, returns sub
profile: Returns name, given_name, family_name, picture, locale, zoneinfo, updated_at
email: Returns email, email_verified

Responses

200application/json

User information response.

schemaobject

substringrequired

Variant

Unique identifier for a user.

Option 1string

Unique identifier for a user.

Unique identifier for a client application.

Option 2string

Unique identifier for a client application.

namestring

given_namestring

family_namestring

preferred_usernamestring

picturestring

localestring

zoneinfostring

updated_atnumber

emailstring

email_verifiedboolean

appstring

Unique identifier for an account.

accstring

Unique identifier for an account.

401

Invalid or expired access token.

defaultapplication/jsonOAuth2Error

Standard OAuth 2.0 / OpenID Connect error response. Used by: token endpoint, introspection, revocation, device authorization, etc.

schemaOAuth2Error

errorstringrequired

The error code as defined in RFC 6749 §5.2 and extensions.

error_descriptionstring

Human-readable text providing additional information.

error_uristring · uri

A URI identifying a human-readable web page with information about the error.

curl -X GET \\
  "${BASE_URL}/oauth2/userinfo" \\
  -H "Authorization: Bearer ${API_TOKEN}"

const url = "${BASE_URL}/oauth2/userinfo";
const response = await fetch(url, {
  method: "GET",
  headers: {
    "Authorization": "Bearer ${API_TOKEN}",
  },
});

console.log(await response.json());

const url = "${BASE_URL}/oauth2/userinfo";
const response = await fetch(url, {
  method: "GET",
  headers: {
    "Authorization": "Bearer ${API_TOKEN}",
  },
} as RequestInit);

console.log(await response.json());

const response = await axios({
  method: "get",
  url: "${BASE_URL}/oauth2/userinfo",
  headers: {
    Authorization: "Bearer ${API_TOKEN}",
  },
});

console.log(response.data);

const response: AxiosResponse = await axios({
  method: "get",
  url: "${BASE_URL}/oauth2/userinfo",
  headers: {
    Authorization: "Bearer ${API_TOKEN}",
  },
});

console.log(response.data);

import { request } from "undici";

const { body } = await request("${BASE_URL}/oauth2/userinfo", {
  method: "GET",
  headers: {
    Authorization: "Bearer ${API_TOKEN}",
  },
});

console.log(await body.json());

import requests

payload = None
response = requests.request( \
    "GET", \
    "${BASE_URL}/oauth2/userinfo", \
    headers={"Authorization": "Bearer ${API_TOKEN}"}, \
    json=payload,
)
print(response.json())

import httpx

payload = None
with httpx.Client() as client:
    response = client.request( \
        "GET", \
        "${BASE_URL}/oauth2/userinfo", \
        headers={"Authorization": "Bearer ${API_TOKEN}"}, \
        json=payload,
    )
print(response.json())

payload := http.NoBody

req, err := http.NewRequest("GET", "${BASE_URL}/oauth2/userinfo", payload)
if err != nil {
  panic(err)
}
req.Header.Set("Authorization", "Bearer ${API_TOKEN}")
if payload != http.NoBody {
  req.Header.Set("Content-Type", "application/json")
}

res, err := (&http.Client{}).Do(req)
if err != nil {
  panic(err)
}
defer res.Body.Close()

require "json"
require "net/http"

payload = nil
uri = URI("${BASE_URL}/oauth2/userinfo")
request = Net::HTTP::Get.new(uri)
request["Authorization"] = "Bearer ${API_TOKEN}"
request["Content-Type"] = "application/json"
response = Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme == "https") { |http| \
  http.request(request) \
}
puts response.body

<?php

use GuzzleHttp\Client;

$payload = null;
$client = new Client();
$response = $client->request("GET", "${BASE_URL}/oauth2/userinfo", [
  'headers' => [
    'Authorization' => 'Bearer ${API_TOKEN}',
  ],
]);

echo $response->getBody();

using System.Net.Http;
using System.Text;

var client = new HttpClient();
var request = new HttpRequestMessage(HttpMethod.Get, "${BASE_URL}/oauth2/userinfo");
request.Headers.Add("Authorization", "Bearer ${API_TOKEN}");
var response = await client.SendAsync(request);
Console.WriteLine(await response.Content.ReadAsStringAsync());

AccessToken

string

A short-lived JWT access token signed by the authentication service

OAuth2Error

errorstringrequired

The error code as defined in RFC 6749 §5.2 and extensions.

error_descriptionstring

Human-readable text providing additional information.

error_uristring · uri

A URI identifying a human-readable web page with information about the error.

ProblemDetails

typestring · urirequired