oauth
Token endpoint
Exchanges an authorization code for access and refresh tokens, or
refreshes an expired access token. The request is authenticated with
your client credentials using HTTP Basic auth
(base64(client_id:client_secret)).
Include the resource parameter (RFC 8707) to bind the access token
to the Klang REST API. If omitted, Klang injects it automatically for
ext_-prefixed clients.
POST
/api/auth/oauth2/token Response fields
| access_token string | RS256 JWT. Claims include user_id, workspace_id, tenant_id, client_type, scope, and aud. |
| token_type "Bearer" | |
| expires_in integer | Access token lifetime in seconds (typically 3600). |
| refresh_token string | Use with grant_type=refresh_token to renew the access token. |
| id_token string | OIDC ID token (JWT) with user identity claims. |
| scope string | Space-separated list of granted scopes. |