Create access token

Request

OAuth2 token endpoint (RFC 6749 Section 3.2). Supports the authorization_code, client_credentials, and refresh_token grant types.

Client authentication. Authenticate with HTTP Basic (Authorization: Basic base64(client_id:client_secret)) or with client_id and client_secret in the request body — not both at once (RFC 6749 Section 2.3.1).

PKCE (RFC 7636). When the authorization request included a code_challenge, the matching code_verifier is required here. A mismatch or a code_verifier for a code issued without a challenge is rejected with invalid_grant. S256 and plain challenge methods are supported.

Refresh tokens. Rotate on every use: a successful refresh_token grant retires the presented token and returns a replacement. Refresh tokens expire 30 days after issuance; rotation restarts that window. The authorization_code grant returns a refresh token only when the client is registered for the refresh_token grant type. The client_credentials grant never returns one (RFC 6749 Section 4.4.3).

Scopes. scope is space-separated per RFC 6749 (comma-separated values are additionally tolerated). Must be a subset of the scopes previously granted (authorization code or refresh token) or registered (client credentials).

Errors follow RFC 6749 Section 5.2: 400 (or 401 for invalid_client) with the standard error codes such as invalid_grant, invalid_client, unauthorized_client, unsupported_grant_type, and invalid_scope.

Bodyapplication/x-www-form-urlencodedrequired

grant_typestringrequired

The OAuth2 grant type.

Enum:"authorization_code""client_credentials""refresh_token"

client_idstring

Client identifier. Omit when authenticating with HTTP Basic.

client_secretstring

Client secret. Omit when authenticating with HTTP Basic.

codestring

The authorization code (required for authorization_code).

redirect_uristring, (uri)

Must match the redirect URI used in the authorization request. Required for authorization_code).

code_verifierstring, [ 43 .. 128 ] characters

PKCE code verifier (RFC 7636) Required when the authorization request included a code_challenge.

refresh_tokenstring

The refresh token. Required for refresh_token.

scopestring

Space-separated scopes to request. Defaults to the previously granted or registered scopes.

curl -i -X POST \
  https://cafe.redocly.com/_mock/openapi/cafe/oauth2/token \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d grant_type=client_credentials \
  -d client_id=client_1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d \
  -d client_secret=YOUR_CLIENT_SECRET \
  -d 'scope=menu:read orders:read'

Responses

Token issued successfully. The response is not cacheable (it is served with Cache-Control set to no-store).

Bodyapplication/json

access_tokenstringrequired

The issued access token (opaque string).

token_typestringrequired

Type of the issued token.

Value:"Bearer"

expires_inintegerrequired

Access token lifetime in seconds.

Example:3600

refresh_tokenstring

Refresh token, returned for the authorization_code grant when the client is registered for the refresh_token grant type, and on every refresh (tokens rotate on use). Never returned for the client_credentials grant (RFC 6749 Section 4.4.3).

scopestring

Space-separated scopes granted to the token.

Example:"menu:read orders:read"

Response

{
  "access_token": "string",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "string",
  "scope": "menu:read orders:read"
}