> For the complete documentation index, see [llms.txt](https://docs.corppass.gov.sg/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.corppass.gov.sg/technical-specifications/corppass-authorization-api-legacy/endpoints/token-endpoint.md). # Token Endpoint ``` POST /mga/sps/oauth/oauth20/token ``` This endpoint allows the client to exchange an authorization code for an ID token and an access token. * The ID token is a JWT that includes user information in the `sub` claim and is signed by Corppass. Relying Parties (RPs) can verify the JWT's signature using the public keys available at the Corppass JWKS endpoint. * The Access Token is a signed JWS intended for the Corppass resource server (e.g. `/authorization-info`). ### Supported Grant Types Grant types define the method by which a client obtains tokens from the authorization server. For the Open ID Connect (OIDC) authentication flow, Corppass supports the following grant types:
Grant TypeDescription
authorization_code Used to securely exchange an authorization code for an ID token and access token. Requires prior user authentication and is suitable for confidential clients. Refer to Section 3.1 of the OIDC Core Specification for more details on this grant.
#### Authorization Code Grant The `authorization_code` grant type allows the client to exchange an authorization code (provided to the client after the user is authenticated) for an ID token and an access token. This grant is restricted to **confidential clients**, which must authenticate themselves using **Client Assertion JWT.** The client must include a JSON Web Token (JWT) in the token request body. Corppass will verify the JWT's signature using the public key provided in the JSON Web Key Set (JWKS) during client onboarding. #### Request Request Headers | Header | Value | | ------------ | ------------------------------------------------ | | Content-Type | application/x-www-form-urlencoded; charset=utf-8 | Request Body
FieldDescription
redirect_uri The redirect URI used in the current authentication session.
grant_type The type of grant being requested. This must be set to authorization_code.
code The authorization code issued during the /authorize call.
client_assertion_type Must be set to urn:ietf:params:oauth:client-assertion-type:jwt-bearer
client_assertion A JWT identifying the client. Refer to Client Assertion JWT section for more details about the JWT structure.
client_idThe client identifier assigned to the Relying Party during onboarding with Corppass.
code_verifierA cryptographic random string generated and is used to compare with code_challenge sent during the /authorize or /request call.
#### Response Successful Response Example 
{
    "access_token": "eyJraWQiOiJueGlKSk5OVnh4blRrVTJ3TDY1VEkyUGtJTElKT1VSU1RRU0FCTHVIMmtFIiwiYWxnIjoiRVMyNTYifQ.eyJleHAiOjE2MjQwODQ4MjMsImlhdCI6MTYyNDA4NDIyMywiaXNzIjoiaHR0cHM6Ly9jb3JwcGFzc3JwMDMiLCJhdWQiOiJ2T0lsaldWckd5Qk1LNmYzMVFZcSIsInNjb3BlIjpbImF1dGhpbmZvIiwidHBhdXRoaW5mbyJdfQ.jzzTSQw5w3B_88KgqzThrP237wYWkuuzBdRpHnT4iNoqWAjV8KsXDqwBgOnECsFBeshJXahMDswyqw6xlgTO9g",
    "scope": "openid",
    "id_token": "eyJraWQiOiJueGlKSk5OVnh4blRrVTJ3TDY1VEkyUGtJTElKT1VSU1RRU0FCTHVIMmtFIiwiYWxnIjoiRVMyNTYifQ.eyJlbnRpdHlJbmZvIjp7IkNQRW50SUQiOiJWQlIwMDAwMDQiLCJDUEVudF9UWVBFIjoiVUVOIiwiQ1BFbnRfU3RhdHVzIjoiUmVnaXN0ZXJlZCIsIkNQTm9uVUVOX0NvdW50cnkiOiIiLCJDUE5vblVFTl9SZWdObyI6IiIsIkNQTm9uVUVOX05hbWUiOiIifSwiYW1yIjpbInB3ZCJdLCJpYXQiOjE2MjQwODQyMjIsImlzcyI6Imh0dHBzOi8vY29ycHBhc3NycDAzIiwic3ViIjoicz1udWxsLHU9YW1pdGVzaCxjPW51bGwiLCJhdF9oYXNoIjoiMncxWjlBNW9qZExic2hSLUIwbFV4QSIsImV4cCI6MTYyNDA4NzgyMiwiYXVkIjoidk9JbGpXVnJHeUJNSzZmMzFRWXEifQ.lwTieBCXxOHMtKFkpLZDarzGe5QsZiFnZoWxVoSPLEzPhTABMgStGknzlf9m1hZiw6rCP_4InngFNLeh8DeztA",
    "token_type": "Bearer",
    "expires_in": 599
}
Response Body Fields
FieldRequiredTypeDescription
access_token YesJWSThe access token containing standard claims in JWS format, signed by Corppass. Refer to the Access Token section for more details.
scope YesStringThe scopes granted for the issued tokens. This field may include openid along with other scopes requested during authorization.
id_token YesJWEThe ID token containing relevant claims in JWT format, signed by Corppass. Refer to the ID Token section for more details.
token_type YesStringThe type of token issued. Currently, only Bearer is supported.
expires_inYesNumericThe remaining lifetime of the access token in seconds.