The Token Endpoint

The /token endpoint issues an Access Token, and it supports the grant types from the OAuth 2.0 specifications.

The Client calls this endpoint directly, from its server to your server. The browser is not part of the request, and thus the Client can safely send its client secret.

INFO

• Send each request to /token with the HTTP POST method. Include the client credentials in the Authorization header, or in the request body.

• You can change the URL. /oauth/token and /v1/token are two other common names.

import {
  requestFromExpress,
  handleExpressResponse,
  handleExpressError,
} from "@jmondi/oauth2-server/express";

app.post("/token", async (req: Express.Request, res: Express.Response) => {
  try {
    const oauthResponse = await authorizationServer.respondToAccessTokenRequest(
      requestFromExpress(req),
    );
    return handleExpressResponse(res, oauthResponse);
  } catch (e) {
    handleExpressError(e, res);
    return;
  }
});

Supported Grants

The grant_type parameter selects the flow. Each grant page gives the parameters and an example request and response.

grant_type	Use it to	Specification
authorization_code	Exchange an authorization code for an Access Token	RFC 6749 §4.1
refresh_token	Exchange a Refresh Token for a new Access Token	RFC 6749 §6
client_credentials	Authenticate a machine when there is no user	RFC 6749 §4.4
password	Exchange the credentials of a user	RFC 6749 §4.3
urn:ietf:params:oauth:grant-type:token-exchange	Exchange one security token for a different one	RFC 8693

When you enable OIDC and the server grants the openid scope, the authorization code response also contains an ID Token.

Audience

To set the aud claim (RFC 7519 §4.1.3) of the Access Token, send an aud or audience parameter in the query or the body of the request. The /authorize endpoint accepts the same parameter in the query, but it only records the value on the authorization request. Only the parameter that you send to this endpoint sets the aud claim.

Extra Token Fields

To add more fields to an Access Token, write the extraTokenFields method in your JwtService class.

import { JwtService, type ExtraAccessTokenFieldArgs } from "@jmondi/oauth2-server";

export class MyCustomJwtService extends JwtService {
  extraTokenFields(params: ExtraAccessTokenFieldArgs) {
    const { user = undefined, client, originatingAuthCodeId } = params;
    return {
      email: user?.email,
      originatingAuthCodeId,
      myCustomProps: "this will be in the decoded token!",
    };
  }
}

Supports the following RFCs

RFC6749 (OAuth 2.0), RFC6750 (Bearer Token Usage), RFC8693 (Token Exchange)