Xsolla-logo

JWT generierenClient-side

post/oauth2/token

Use this call:

  • To get a [user JWT](/api/login/overview/#section/Authentifizierung/Benutzertoken abrufen).
  • To refresh the JWT when it expires. Works only if scope=offline is passed in the registration or authentication call.
  • To get a server JWT. The user participation isn’t needed.
  • To exchange user JWT for a new one with different scope.

Usage of this call depends on the value of the grant_type parameter.

Request
Request Body schema: application/x-www-form-urlencoded
grant_type
required
string

The type of getting the JWT. Can be:

  • authorization_code to exchange the code received in the authentication call to the JWT. The value of the code parameter must be specified.
  • refresh_token to get the refreshed JWT when the previous value is expired. The value of the refresh_token parameter must be specified.
  • client_credentials to get the server JWT. The values of the client_id and client_secret parameters must be specified.
  • urn:ietf:params:oauth:grant-type:token_exchange to exchange existing user JWT with different scope.
client_id
required
string

Die ID Ihrer Anwendung. Der Wert dieses Parameters hängt vom Wert des Parameters grant_type ab:

Hinweis: Die Werte der Parameter client_secret und client_id sollten vom selben Client stammen.

refresh_token
string

Wert dieses Parameters, der als Antwort auf die letzte Anfrage dieses Aufrufs mit den Werten authorization_code oder refresh_token im Parameter grant_type empfangen wurde. Erforderlich wenn grant_type=refresh_token.

client_secret
string

Ihr geheimer Schlüssel. Der Wert dieses Parameters hängt vom Wert des Parameters grant_type ab:

  • Bei authorization_code müssen Sie einen OAuth 2.0-Client erstellen und dessen geheimen Schlüssel verwenden. Erforderlich, wenn Sie einen OAuth 2.0-Client erstellt und dabei Vertraulich als Authentifizierungstyp ausgewählt haben.
  • Bei client_credentials müssen Sie sich an Ihren Customer Success Manager wenden. Der Customer Success Manager erstellt den OAuth 2.0-Serverclient und teilt Ihnen dessen geheimen Schlüssel mit. Erforderlich für diesen Client-Typ.

Hinweis: Die Werte der Parameter client_secret und client_id sollten vom selben Client stammen.

redirect_uri
string
code
string

Authentifizierungscode, der gegen einen JWT getauscht wird. Erforderlich, wenn grant_type=authorization_code.

code_verifier
string

Der Codeprüfer für die PKCE-Anfrage, den die App ursprünglich noch vor der Autorisierungsanfrage generiert hat.

audience
string

Liste der Domains, auf die Token angewandt werden können

scope
string

A list of space-delimited, case-sensitive strings, as defined in Section 3.3 of [RFC6749], that allow the client to specify the desired scope of the requested security token in the context of the service or resource where the token will be used. The values and associated semantics of scope are service specific and expected to be described in the relevant service documentation

subject_token
string

A security token that represents the identity of the party on behalf of whom the request is being made. Typically, the subject of this token will be the subject of the security token issued in response to the request.

subject_token_type
string

A security token that represents the identity of the party on behalf of whom the request is being made. Typically, the subject of this token will be the subject of the security token issued in response to the request.

Value: "access_token"
actor_token
string

A security token that represents the identity of the acting party. Typically, this will be the party that is authorized to use the requested security token and act on behalf of the subject.

actor_token_type
string

An identifier, as described in Section 3, that indicates the type of the security token in the actor_token parameter. This is REQUIRED when the actor_token parameter is present in the request but MUST NOT be included otherwise.

Value: "server_token"
Responses
200

OK

400

Bad Request

404

Not Found

418

I’m a teapot

422

Unprocessable Entity

429

Too Many Requests

Request samples
application/x-www-form-urlencoded
refresh_token=string&grant_type=string&client_secret=string&client_id=string&redirect_uri=string&code=string&code_verifier=string&audience=string&scope=string&subject_token=string&subject_token_type=access_token&actor_token=string&actor_token_type=server_token
Response samples
application/json
{
  • "access_token": "2YotnFZFEjr1zCsicMWpAA",
  • "expires_in": 3600,
  • "refresh_token": "tGzv3JOkF0XG5Qx2TlKWIA",
  • "scope": "email user_profile",
  • "token_type": "bearer"
}