TrueVault Identity Manager

Token Exchange

POST /oauth/oidc/token

Exchange an authorization code for tokens, or refresh an existing token.

Authorization Code Grant

Exchange the authorization code received from the callback for an access token, ID token, and refresh token. Requires the original PKCE code_verifier.

Refresh Token Grant

Use a refresh token to obtain a new access token.

Request body

Content type application/x-www-form-urlencoded

AuthorizationCodeGrant

FieldTypeRequiredDescription
grant_type string yes

Must be authorization_code.

One of: authorization_code
code string yes

Authorization code received from the callback redirect.
redirect_uri string yes

Must match the redirect URI used in the authorization request.
code_verifier string yes

The original PKCE code verifier used to generate the code challenge.

Example: AuthorizationCodeGrant

{
  "grant_type": "authorization_code",
  "code": "string",
  "redirect_uri": "string",
  "code_verifier": "string"
}

RefreshTokenGrant

FieldTypeRequiredDescription
grant_type string yes

Must be refresh_token.

One of: refresh_token
refresh_token string yes

Refresh token from a previous token exchange.

Example: RefreshTokenGrant

{
  "grant_type": "refresh_token",
  "refresh_token": "string"
}

Responses

StatusDescription
200 OK

Token response

400 Bad Request

Invalid grant or request

401 Unauthorized

Invalid client credentials

Content type application/json

TokenResponse (200)

FieldTypeRequiredDescription
access_token string no

Access token for accessing protected resources.
token_type string no

Token type. Always Bearer.
expires_in integer no

Token lifetime in seconds.
id_token string no

JWT containing identity claims about the authenticated user.
refresh_token string no

Token used to obtain new access tokens.
session_state string no

Session state for session management.
scope string no

Granted scopes (space-separated).

Example 200 response

{
  "access_token": "string",
  "token_type": "Bearer",
  "expires_in": 3600,
  "id_token": "string",
  "refresh_token": "string",
  "session_state": "string",
  "scope": "string"
}

Content type application/json

OAuthError (400, 401)

FieldTypeRequiredDescription
error string no

Error code as defined in RFC 6749.
error_description string no

Human-readable error description.

Example 400 response

{
  "error": "invalid_grant",
  "error_description": "The authorization code has expired or is invalid."
}

Example request

curl --request POST \
  --url https://sandbox.truevault.com.au/oauth/oidc/token \
  --header 'Content-Type: application/json'