Token Endpoint

POST

/oidc/token

curl --request POST \
  --url https://auth.timetonic.com/oidc/token \
  --header 'Content-Type: application/x-www-form-urlencoded' \
  --data grant_type=authorization_code \
  --data code=example \
  --data redirect_uri=example \
  --data code_verifier=example \
  --data refresh_token=example \
  --data client_id=example \
  --data client_secret=example

Exchange an authorization code or refresh token for OIDC tokens. Supports grant_type=authorization_code (with PKCE) and grant_type=refresh_token.

Request Body^required

Media typeapplication/x-www-form-urlencoded

object

grant_type

required

string

Allowed values: authorization_code refresh_token

code

string

redirect_uri

string

code_verifier

string

refresh_token

string

client_id

string

client_secret

string

Responses

200

Token response

Media typeapplication/json

object

access_token

string

token_type

string

Allowed values: Bearer

expires_in

integer

refresh_token

string

id_token

string

scope

string

Example

{
  "token_type": "Bearer"
}

400

OAuth error (invalid_request, invalid_grant, etc.)