Skip to main content
POST
Exchange machine-client credentials for an access token

Body

application/x-www-form-urlencoded
grant_type
enum<string>
required

client_credentials for a machine client. Other grants are accepted only when enabled — see grant_types_supported in the authorization-server metadata.

Available options:
client_credentials
resource
string<uri>
required

The exact approved resource URI (RFC 8707). Becomes the token's aud.

scope
string
required

Space-delimited requested scopes. Required and non-empty — an absent or empty scope is invalid_scope, never a request for the full entitlement. Every scope must be covered by an effective grant for this resource.

Example:

"tasks:read tasks:write"

client_assertion_type
enum<string>

Required with client_assertion (private_key_jwt).

Available options:
urn:ietf:params:oauth:client-assertion-type:jwt-bearer
client_assertion
string

Signed RFC 7523 client assertion (private_key_jwt).

Response

Access token issued

access_token
string
required

RS256 at+jwt access token. See AccessTokenClaims.

token_type
enum<string>
required
Available options:
Bearer
expires_in
integer
default:300
required

Lifetime in seconds actually applied to this token. The default is 300 (five minutes). Operators can tune it, but the value is hard-capped at the 900-second (fifteen-minute) ceiling — a configured value above the ceiling is clamped down to it. Read the lifetime from this field rather than assuming either number.

Required range: x <= 900
scope
string

The granted space-delimited scopes (the requested set).