API ReferenceInbound Apps (OAuth)
POST
oauth2/v1/apps/tokenRequest Body
application/json
grant_type?string
code?string
client_id?string
client_secret?string
code_verifier?string
scope?string
refresh_token?string
tenantId?string
resource?string
RFC 8707 - OAuth 2.0 Resource Indicators - Token Endpoint only supports receiving a single resource
audience?string
assertion?string
client_assertion_type?string
jwt-spiffe (draft-ietf-oauth-spiffe-client-auth) is accepted only from workloadIdentity apps; the service enforces that.
client_assertion?string
device_code?string
project_id?string
mcp_server_id?string
subject_token?string
subject_token_type?string
auth_req_id?string
requested_token_type?string
RFC 8693 requested_token_type. Empty/access_token => access token (default). id-jag => issue a Cross-App Access Identity Assertion Authorization Grant.
authorization_details?string
session_id?string
Poppy Session to continue; only for the code, device code and refresh token grants
redirect_uri?string
Exchange authorization codes, refresh tokens, client credentials, JWT bearer assertions, and RFC 8693 token-exchange requests for Inbound App access tokens.
Supported grant_type values and examples are documented in Authorization server endpoints and Using Inbound Apps.
curl -X POST "https://api.descope.com/oauth2/v1/apps/token" \ -H "Content-Type: application/json" \ -d '{}'{ "access_token": "string", "token_type": "string", "refresh_token": "string", "id_token": "string", "expires_in": 0, "scope": "string", "error": "string", "description": "string", "issued_token_type": "string", "authorization_details": { "values": [ null ] }, "session_id": "string", "signed_in": true, "refresh_token_expires_in": 0}export interface Response {access_token?: stringtoken_type?: stringrefresh_token?: stringid_token?: stringexpires_in?: numberscope?: string/** * Those fields are in use just in case of error of device flow scenario (where device polling on the specific error response) */error?: stringdescription?: stringissued_token_type?: stringauthorization_details?: GoogleProtobuf/** * Poppy Session this token belongs to; absent when the request did not use a Poppy Session */session_id?: string/** * Whether the Poppy Session is signed in to an account; absent when the request did not use a Poppy Session */signed_in?: boolean/** * Lifetime in seconds of the refresh token born from a Poppy Session sign-in */refresh_token_expires_in?: number}/** * `ListValue` is a wrapper around a repeated field of values. * * The JSON representation for `ListValue` is JSON array. */export interface GoogleProtobuf {/** * Repeated field of dynamically typed values. */values?: {[k: string]: unknown}[]} Was this helpful?