{"revision":"9f11a31dd2951db0","language":"en","entry":{"id":"oidc-token","kind":"endpoint","group":"oidc","title":"Exchange a code or a refresh token","method":"POST","path":"/oidc/token","paths":[],"summary":"The token endpoint: the code with its PKCE verifier, or a refresh token, for an access token, an ID token and a new refresh token.","response":"{access_token, token_type: Bearer, expires_in: 600, refresh_token?, id_token, scope}.","parameters":[],"sample":"/oidc/token","access":"private-code","base":"directory","notes":["Errors of this endpoint follow OAuth: `{\"error\", \"error_description\"}` (RFC 6749, 5.2), not the `error` object of the rest of the API. A rate limit still answers 429 with the usual envelope.","application/x-www-form-urlencoded, at most 16 KiB, each parameter once. A confidential app uses Basic authentication.","No API key is read here: an Authorization header on /oidc/ is the app's or the person's own credential."],"errors":["400 invalid_grant","400 invalid_request","400 invalid_scope","400 unsupported_grant_type","401 invalid_client","404 invalid_request","429 rate_limited","500 internal_error","503 busy"],"related":["sign-in-with-veil"],"sections":[{"kind":"code","language":"shell","code":"curl -fsS -u \"$CLIENT_ID:$CLIENT_SECRET\" \\\n  -d grant_type=authorization_code -d code=\"$CODE\" -d code_verifier=\"$VERIFIER\" \\\n  --data-urlencode redirect_uri=https://app.example.org/callback \"https://veil.rip/oidc/token\""}],"live":false,"responses":[{"status":200,"contentType":"application/json","description":"{access_token, token_type: Bearer, expires_in: 600, refresh_token?, id_token, scope}.","fields":[{"name":"access_token","type":"string","description":"Opaque, veil_at_…, 10 minutes. Kept only as a hash."},{"name":"token_type","type":"string","description":"Bearer."},{"name":"expires_in","type":"integer","description":"600."},{"name":"refresh_token","type":"string","description":"veil_rt_…, 30 days, rotated at every use, at most 90 days from the login. Missing for an app without refresh."},{"name":"id_token","type":"string","description":"JWT signed with the app's algorithm (EdDSA or ES256), kid in the header."},{"name":"scope","type":"string","description":"The scopes granted."}]}],"responseObjects":[],"errorFormat":"json","errorDetails":[{"status":400,"code":"invalid_grant","description":"OAuth error: the code or refresh token is invalid, expired, used, revoked or another app's, or the PKCE verifier does not match. A code or refresh token used twice ends every token of its login.","action":"Start the sign-in again. Never retry a code.","scope":"endpoint"},{"status":400,"code":"invalid_request","description":"OAuth error: a parameter is missing, given twice or malformed, or the body is not a form.","action":"Read `error_description`, fix the request and send it again.","scope":"endpoint"},{"status":400,"code":"invalid_scope","description":"OAuth error: a refresh asked for a scope the login did not grant, or left out openid.","action":"Keep or narrow the scopes, with openid. A new scope needs a new sign-in.","scope":"endpoint"},{"status":400,"code":"unsupported_grant_type","description":"OAuth error: grant_type is not authorization_code or refresh_token.","action":"Use one of the two grant types.","scope":"endpoint"},{"status":401,"code":"invalid_client","description":"OAuth error: the app could not be authenticated, with the method it registered.","action":"Check the client id and secret (Basic), the client assertion (private_key_jwt, a new jti each time) or client_id for a public app.","scope":"endpoint"},{"status":404,"code":"invalid_request","description":"OAuth error: Sign in with Veil is not configured on this server.","action":"Use https://veil.rip, or a server whose discovery document answers.","scope":"endpoint"},{"status":429,"code":"rate_limited","description":"An anonymous, signed-request or API-key allowance was exceeded.","action":"Wait at least `Retry-After` seconds. Share a queue and retry budget across your workers.","scope":"common"},{"status":500,"code":"internal_error","description":"An unexpected server error occurred. Internal details are not returned.","action":"Retry reads with bounded backoff. Check write results before sending a new signed operation.","scope":"common"},{"status":503,"code":"busy","description":"The application has reached a temporary concurrency or database limit.","action":"Wait `Retry-After` seconds and retry with bounded backoff.","scope":"common"}],"responseHeaders":[{"name":"Content-Type","value":"application/json","description":"JSON, also for errors."},{"name":"Cache-Control","value":"no-store","description":"Private: never cached."},{"name":"Pragma","value":"no-cache","description":"RFC 6749, 5.1."}],"bodyFields":[{"name":"grant_type","in":"body","required":true,"description":"authorization_code or refresh_token."},{"name":"code","in":"body","required":false,"description":"The code (authorization_code)."},{"name":"redirect_uri","in":"body","required":false,"description":"The same as in the request (authorization_code)."},{"name":"code_verifier","in":"body","required":false,"description":"The PKCE verifier, 43 to 128 characters (authorization_code)."},{"name":"refresh_token","in":"body","required":false,"description":"The refresh token (refresh_token)."},{"name":"scope","in":"body","required":false,"description":"A refresh may narrow the scopes."},{"name":"client_id","in":"body","required":false,"description":"A public app names itself here."},{"name":"client_assertion, client_assertion_type","in":"body","required":false,"description":"private_key_jwt (RFC 7523): a JWT signed by a key of the app's jwks, aud the issuer or this endpoint, exp within 5 minutes, a new jti."}],"verify":"In the ID token check the signature with the JWKS key its kid names, iss, aud and azp (your client_id), exp, and nonce. With the veil scope, veil_consent can be checked too: see the guide.","documentationUrl":"https://veil.rip/docs/oidc-token","supportsBrowserFetch":false,"browserMode":"local-or-server"}}