Skip to main content

Documentation Index

Fetch the complete documentation index at: https://auth0-feat-authentication-api-migration.mintlify.app/llms.txt

Use this file to discover all available pages before exploring further.

POST /oauth/token
This flow is intended for use with native social interactions only. Use of this flow outside of a native social setting is highly discouraged.
When a non-browser-based solution (such as a mobile platform’s SDK) authenticates the user, the authentication will commonly result in artifacts being returned to application code. In such situations, this grant type allows for the Auth0 platform to accept artifacts from trusted sources and issue tokens in response. In this way, apps making use of non-browser-based authentication mechanisms (as are common in native apps) can still retrieve Auth0 tokens without asking for further user interaction. Artifacts returned by this flow (and the contents thereof) will be determined by the subject_token_type and the tenant’s configuration settings.

​
Remarks

  • The scopes issued to the application may differ from the requested scopes. In this case, a scope parameter will be included in the response JSON.
  • If you don’t request specific scopes, all scopes defined for the audience will be returned due to the implied trust to the application in this grant. You can customize the scopes returned in a rule. To learn more, read Calling APIs from Highly Trusted Applications.

​
Learn More

​
Parameters

​
DPoP
string
A DPoP proof for the request. This is optional and only required if your application uses Demonstrating Proof-of-Possession.

​
Request Body

​
auth0-forwarded-for
string
End user IP as a string value. Set this if you want brute-force protection to work in server-side scenarios. To learn more about how and when to use this header, read Using resource owner password from server-side.
​
grant_type
string
required
Denotes the flow you are using. For Token Exchange for Native Social, use urn:ietf:params:oauth:grant-type:token-exchange.
​
subject_token
string
required
Externally-issued identity artifact representing the user.
​
subject_token_type
string
required
Identifier that indicates the type of subject_token.
​
client_id
string
required
Your application’s Client ID.
​
audience
string
The unique identifier of the target API you want to access.
​
resource
string
The identifier of the target API (resource server) you want to access. Must match an API Identifier registered in your Auth0 tenant. Used as an alternative to audience when the tenant’s Resource Parameter Compatibility Profile is set to compatibility.
​
scope
string
String value of the different scopes the application is requesting. Multiple scopes are separated with whitespace.
​
user_profile
object
Optional element used for native iOS interactions for which profile updates can occur. Expected parameter value will be JSON in the form of: { name: { firstName: 'John', lastName: 'Smith' }}.

​
Response

StatusDescription
200Successful response
defaultUnexpected error