Step 8: Get the access token

POST {{authPath}}/{{envID}}/as/token

Use the POST {{authPath}}/{{envID}}/as/token request to acquire the access token by presenting the client’s (the Web application’s) authorization grant.

This request requires Basic authentication, in which the application ID from Step 2 and the application secret from Step 3 are used to authenticate this request. If you’re using Postman, these values are already set for you. In a curl command, you can use the --user parameter to satisfy the Basic authentication requirement like this: --user "{{appID}}:{{appSecret}}".

In this request:

{{authPath}} is the geographic regional domain to use for authentication and authorization for your PingOne environment. The PingOne top-level domain is https://auth.pingone.com/v1 for the U.S. Refer to PingOne API domains for the top-level domains for other regions.
{{envID}} is the environment ID for the environment you created in the prior workflow to create your test environment.

In the request body:

grant_type is a String containing the grant type of the token request. In this example, the value needs to be authorization_code.
code is a String containing the authorization code value returned by the authorization request.
redirect_uri is a String containing the URL for the return entry point of the Web application.

A successful response contains the access token and the ID token. In receiving these tokens from PingOne, the user you created has completed the sign-on flow to access their account on the Web application you configured in Step 2. The redirect_uri property in this request specifies the entry point on the Web application for authenticated users. The workflow redirects to that redirect_uri URL, and the access token verifies your user’s credentials for account access on the Web application.

Troubleshooting

Verify that the authorization code returned by the resume endpoint is set as the value for the code property in the request body.
Verify that the value of redirect_uri here matches the redirect_uri value that you set when you created the Web application in Step 2: Create a Web application.
Verify that {{authPath}} is correct for your geographic region.

Headers

Authorization

Content-Type application/x-www-form-urlencoded

Body

urlencoded ( application/x-www-form-urlencoded )

Key	Value
grant_type	authorization_code
code	{{authCode}}
redirect_uri	http://localhost:3000/callback
scope	openid

Key

Value

grant_type

authorization_code

code

redirect_uri

http://localhost:3000/callback

scope

openid

Example Request

curl --location --globoff '{{authPath}}/{{envID}}/as/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic e3tzb2x1dGlvbkFwcElEfX06e3tzb2x1dGlvbkFwcFNlY3JldH19' \
--data-urlencode 'grant_type=authorization_code' \
--data-urlencode 'code={{authCode}}' \
--data-urlencode 'redirect_uri=http://localhost:3000/callback' \
--data-urlencode 'scope=openid'

var options = new RestClientOptions("{{authPath}}/{{envID}}/as/token")
{
  MaxTimeout = -1,
};
var client = new RestClient(options);
var request = new RestRequest("", Method.Post);
request.AddHeader("Content-Type", "application/x-www-form-urlencoded");
request.AddHeader("Authorization", "Basic e3tzb2x1dGlvbkFwcElEfX06e3tzb2x1dGlvbkFwcFNlY3JldH19");
request.AddParameter("grant_type", "authorization_code");
request.AddParameter("code", "{{authCode}}");
request.AddParameter("redirect_uri", "http://localhost:3000/callback");
request.AddParameter("scope", "openid");
RestResponse response = await client.ExecuteAsync(request);
Console.WriteLine(response.Content);

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "{{authPath}}/{{envID}}/as/token"
  method := "POST"

  payload := strings.NewReader("grant_type=authorization_code&code=%7B%7BauthCode%7D%7D&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcallback&scope=openid")

  client := &http.Client {
  }
  req, err := http.NewRequest(method, url, payload)

  if err != nil {
    fmt.Println(err)
    return
  }
  req.Header.Add("Content-Type", "application/x-www-form-urlencoded")
  req.Header.Add("Authorization", "Basic e3tzb2x1dGlvbkFwcElEfX06e3tzb2x1dGlvbkFwcFNlY3JldH19")

  res, err := client.Do(req)
  if err != nil {
    fmt.Println(err)
    return
  }
  defer res.Body.Close()

  body, err := io.ReadAll(res.Body)
  if err != nil {
    fmt.Println(err)
    return
  }
  fmt.Println(string(body))
}

POST /{{envID}}/as/token HTTP/1.1
Host: {{authPath}}
Content-Type: application/x-www-form-urlencoded
Authorization: Basic e3tzb2x1dGlvbkFwcElEfX06e3tzb2x1dGlvbkFwcFNlY3JldH19

grant_type=authorization_code&code=%7B%7BauthCode%7D%7D&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcallback&scope=openid

OkHttpClient client = new OkHttpClient().newBuilder()
  .build();
MediaType mediaType = MediaType.parse("application/x-www-form-urlencoded");
RequestBody body = RequestBody.create(mediaType, "grant_type=authorization_code&code={{authCode}}&redirect_uri=http://localhost:3000/callback&scope=openid");
Request request = new Request.Builder()
  .url("{{authPath}}/{{envID}}/as/token")
  .method("POST", body)
  .addHeader("Content-Type", "application/x-www-form-urlencoded")
  .addHeader("Authorization", "Basic e3tzb2x1dGlvbkFwcElEfX06e3tzb2x1dGlvbkFwcFNlY3JldH19")
  .build();
Response response = client.newCall(request).execute();

var settings = {
  "url": "{{authPath}}/{{envID}}/as/token",
  "method": "POST",
  "timeout": 0,
  "headers": {
    "Content-Type": "application/x-www-form-urlencoded",
    "Authorization": "Basic e3tzb2x1dGlvbkFwcElEfX06e3tzb2x1dGlvbkFwcFNlY3JldH19"
  },
  "data": {
    "grant_type": "authorization_code",
    "code": "{{authCode}}",
    "redirect_uri": "http://localhost:3000/callback",
    "scope": "openid"
  }
};

$.ajax(settings).done(function (response) {
  console.log(response);
});

var request = require('request');
var options = {
  'method': 'POST',
  'url': '{{authPath}}/{{envID}}/as/token',
  'headers': {
    'Content-Type': 'application/x-www-form-urlencoded',
    'Authorization': 'Basic e3tzb2x1dGlvbkFwcElEfX06e3tzb2x1dGlvbkFwcFNlY3JldH19'
  },
  form: {
    'grant_type': 'authorization_code',
    'code': '{{authCode}}',
    'redirect_uri': 'http://localhost:3000/callback',
    'scope': 'openid'
  }
};
request(options, function (error, response) {
  if (error) throw new Error(error);
  console.log(response.body);
});

import requests

url = "{{authPath}}/{{envID}}/as/token"

payload = 'grant_type=authorization_code&code=%7B%7BauthCode%7D%7D&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcallback&scope=openid'
headers = {
  'Content-Type': 'application/x-www-form-urlencoded',
  'Authorization': 'Basic e3tzb2x1dGlvbkFwcElEfX06e3tzb2x1dGlvbkFwcFNlY3JldH19'
}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)

<?php
require_once 'HTTP/Request2.php';
$request = new HTTP_Request2();
$request->setUrl('{{authPath}}/{{envID}}/as/token');
$request->setMethod(HTTP_Request2::METHOD_POST);
$request->setConfig(array(
  'follow_redirects' => TRUE
));
$request->setHeader(array(
  'Content-Type' => 'application/x-www-form-urlencoded',
  'Authorization' => 'Basic e3tzb2x1dGlvbkFwcElEfX06e3tzb2x1dGlvbkFwcFNlY3JldH19'
));
$request->addPostParameter(array(
  'grant_type' => 'authorization_code',
  'code' => '{{authCode}}',
  'redirect_uri' => 'http://localhost:3000/callback',
  'scope' => 'openid'
));
try {
  $response = $request->send();
  if ($response->getStatus() == 200) {
    echo $response->getBody();
  }
  else {
    echo 'Unexpected HTTP status: ' . $response->getStatus() . ' ' .
    $response->getReasonPhrase();
  }
}
catch(HTTP_Request2_Exception $e) {
  echo 'Error: ' . $e->getMessage();
}

require "uri"
require "net/http"

url = URI("{{authPath}}/{{envID}}/as/token")

http = Net::HTTP.new(url.host, url.port);
request = Net::HTTP::Post.new(url)
request["Content-Type"] = "application/x-www-form-urlencoded"
request["Authorization"] = "Basic e3tzb2x1dGlvbkFwcElEfX06e3tzb2x1dGlvbkFwcFNlY3JldH19"
request.body = "grant_type=authorization_code&code=%7B%7BauthCode%7D%7D&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcallback&scope=openid"

response = http.request(request)
puts response.read_body

let parameters = "grant_type=authorization_code&code=%7B%7BauthCode%7D%7D&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fcallback&scope=openid"
let postData =  parameters.data(using: .utf8)

var request = URLRequest(url: URL(string: "{{authPath}}/{{envID}}/as/token")!,timeoutInterval: Double.infinity)
request.addValue("application/x-www-form-urlencoded", forHTTPHeaderField: "Content-Type")
request.addValue("Basic e3tzb2x1dGlvbkFwcElEfX06e3tzb2x1dGlvbkFwcFNlY3JldH19", forHTTPHeaderField: "Authorization")

request.httpMethod = "POST"
request.httpBody = postData

let task = URLSession.shared.dataTask(with: request) { data, response, error in
  guard let data = data else {
    print(String(describing: error))
    return
  }
  print(String(data: data, encoding: .utf8)!)
}

task.resume()

Example Response

200 OK

{
    "access_token": "eyJhbGciOiJSUz...",
    "token_type": "Bearer",
    "expires_in": 3600,
    "scope": "openid",
    "id_token": "eyJhbGciOiJSUz..."
}

PingOne Platform APIs