POST https://example.com/authenticationserver/token

Description

Requests an access token like POST /oauth/token, with the same parameters, authorization and responses, but without forwarding an unsuccessful request to the registered authentication servers. The endpoint was added in DS Server 3.1.0.

When POST /oauth/token can't authorize a request, DS Server sends the same form data and Basic authorization header to /authenticationserver/token of the registered authentication servers and returns the answer.

Examples

This sample requests an access token with the "client_credentials" grant type.

# Request:
curl --request POST 'https://trial.dsserver.io/authenticationserver/token' \
    --user 'yourclientid:yourclientsecret' \
    --data-urlencode 'grant_type=client_credentials'

# Response:
{
    "access_token": "nmZ80Zn2R0P2AbS149E31IUHd5aZgB9T",
    "token_type": "Bearer",
    "expires_in": "3600"
}

Authorization

The "client_credentials" grant type requires the Basic authorization method. For the "authorization_code" grant type, the client ID and client secret are sent as the form fields client_id and client_secret instead.

Basic

Header field	Description
Authorization	The client ID and the client secret of the security profile are combined into a string separated by a colon, e.g.: clientid:clientsecret. The resulting string is encoded using the RFC2045-MIME variant of Base64, except not limited to 76 char/line. The authorization method and a space i.e. "Basic " is then put before the encoded string. For example: `Authorization: Basic QWxhZGRpbjpPcGVuU2VzYW1l`

Request Payload

Type	Value
TokenData	The form fields of POST /oauth/token in the "application/x-www-form-urlencoded" format.

Success Response

Status	Description
200	On success, the HTTP status code in the response header is 200 (OK). It returns a JSON object with `access_token`, `token_type` and `expires_in`, as POST /oauth/token does. The "authorization_code" and "refresh_token" grant types also return a new `refresh_token`.

Error Response

The 400 errors return a JSON object with the fields error and error_description, as POST /oauth/token does. The table lists some of them; all of them are listed on POST /oauth/token.

Status	Description
400	`invalid_request` "Missing authorization header." is returned, if the "client_credentials" grant type is requested without a Basic authorization header.
400	`invalid_client` "Invalid client ID." or "Invalid client secret." is returned, if the client credentials don't match a security profile of this instance.
400	`unsupported_grant_type` "This security profile does not allow the specified grant type. (client_credentials)" is returned, if the grant type is not supported or not allowed for the security profile. The grant type that was sent is given in parentheses.

POST /authenticationserver/token