SignInService / Client / create_oauth2_token

create_oauth2_token

SignInService.Client.create_oauth2_token(**kwargs)

Exchanges an authorization code or refresh token for an OAuth 2.0 access token and refresh token.

See also: AWS API Documentation

Request Syntax

response = client.create_oauth2_token(
    tokenInput={
        'clientId': 'string',
        'grantType': 'string',
        'code': 'string',
        'redirectUri': 'string',
        'codeVerifier': 'string',
        'refreshToken': 'string'
    }
)
Parameters:

tokenInput (dict) –

[REQUIRED]

Flattened token operation inputs. The “grant_type” in the request body determines the specific operation.

  • clientId (string) – [REQUIRED]

    The OAuth 2.0 client identifier. Expected values: “arn:aws:signin:::devtools/same-device” or “arn:aws:signin:::devtools/cross-device”.

  • grantType (string) – [REQUIRED]

    The OAuth 2.0 grant type. Supported values:

    • ”authorization_code” - Exchange an authorization code for tokens.

    • ”refresh_token” - Use a refresh token to obtain a new access token.

  • code (string) –

    The authorization code received from the “/v1/authorize” endpoint. Required when “grant_type=authorization_code”.

  • redirectUri (string) –

    The redirect URI that was used in the original authorization request. Must match exactly. Required when “grant_type=authorization_code”.

  • codeVerifier (string) –

    The PKCE code verifier that proves possession of the original code challenge. Required when “grant_type=authorization_code”.

  • refreshToken (string) –

    The refresh token issued by a previous token response. Required when “grant_type=refresh_token”.

Return type:

dict

Returns:

Response Syntax

{
    'tokenOutput': {
        'accessToken': {
            'accessKeyId': 'string',
            'secretAccessKey': 'string',
            'sessionToken': 'string'
        },
        'tokenType': 'string',
        'expiresIn': 123,
        'refreshToken': 'string',
        'idToken': 'string'
    }
}

Response Structure

  • (dict) –

    Output structure for CreateOAuth2Token operation

    Contains flattened token operation outputs for both authorization code and refresh token flows. The response content depends on the grant_type from the original request.

    • tokenOutput (dict) –

      Flattened token operation outputs. The specific response fields depend on the grant_type used in the request.

      • accessToken (dict) –

        The access token issued by the authorization server. The token contains temporary AWS security credentials that you use to sign requests with SigV4.

        • accessKeyId (string) –

          The AWS access key ID for the temporary credentials.

        • secretAccessKey (string) –

          The AWS secret access key used to sign requests.

        • sessionToken (string) –

          The session token that validates the temporary security credentials.

      • tokenType (string) –

        The type of token issued. Value is “aws_sigv4”.

      • expiresIn (integer) –

        The number of seconds until the access token expires. Maximum value is 900 seconds (15 minutes).

      • refreshToken (string) –

        A refresh token that can be used to obtain new access tokens without re-authenticating.

      • idToken (string) –

        A JSON Web Token (JWT) containing user identity claims. Present only when “grant_type=authorization_code”. Not included in refresh token responses.

Exceptions