Service: OAuth2 Token

This service is an endpoint to obtain an OAuth2 access token. Only registered clients can obtain access tokens (see the client registration service).

OAuth2 token requests can be sent with different kinds of grants. The request requirements depend on the specified grant. Kustvakt supports the following grants:

• Authorization code

  Access tokens are obtained by using authorization code.

• Password

  Access tokens are requested by using user credentials. Password grant is only allowed for trusted or super clients, e.g. KorAP web UI Kalamar.

• Refresh token

  Access tokens are obtained by using refresh tokens.

Response

An access token is returned as a JSON object together with authorization scope, token type and token expiration in seconds. A refresh token is also issued for confidential clients. Both public and confidential clients may issue multiple access tokens.

Example

{
    "access_token": "4dcf8784ccfd26fac9bdb82778fe60e2",
    "refresh_token" : "hlWci75xb8atDiq3924NUSvOdtAh7Nlf9z",
    "scope": "search match_info",
    "token_type": "Bearer",
    "expires_in": 259200
}

References

Hardt, D., Ed., The OAuth 2.0 Authorization Framework, RFC 6749, October 2012. [Online]. Available: https://tools.ietf.org/html/rfc6749

Parecki, Aaron. OAuth 2.0 Servers. [Online]. Available: https://www.oauth.com/