Token Endpoint

แลก authorization code เป็น tokens, refresh token เพื่อขอ access token ใหม่, หรือขอ token ด้วย client credentials

Endpoint นี้ส่ง response ตรงตามมาตรฐาน OAuth 2.0 โดยไม่ wrap ใน {code, payload}

Endpoint


POST /oauth2/v1/token
Content-Type: application/json

Grant Type: authorization_code

แลก authorization code จาก Authorization Code Flow เป็น tokens

Request Parameters

Parameter	Type	Required	Description
`grant_type`	string	✅	ต้องเป็น `authorization_code`
`code`	string	✅	Authorization code จาก authorization endpoint
`client_id`	string	✅	Client application ID
`redirect_uri`	string	✅	ต้องตรงกับ authorization request
`client_secret`	string	🔷	Required สำหรับ confidential clients (ถ้าไม่ได้ใช้ PKCE)
`code_verifier`	string	🔷	Required ถ้าใช้ PKCE

ต้องระบุ client_secret หรือ code_verifier อย่างใดอย่างหนึ่ง ขึ้นอยู่กับว่าใช้ Client Secret Authentication หรือ PKCE

Success Response


{
  "token_type": "Bearer",
  "expires_in": 3600,
  "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjEyMyJ9...",
  "refresh_token": "REFRESH_TOKEN_STRING",
  "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjEyMyJ9...",
  "scope": "openid profile email"
}

id_token จะมีเฉพาะเมื่อ scope มี openid เท่านั้น

Access Token Payload (decoded)


{
  "iss": "https://auth.humansoft.co.th",
  "aud": "my-app",
  "sub": "user-credential-id",
  "iat": 1735090800,
  "scope": "openid profile email",
  "user_id": "456"
}

ID Token Payload (decoded)


{
  "iss": "https://auth.humansoft.co.th",
  "aud": "my-app",
  "sub": "user-credential-id",
  "iat": 1735090800,
  "scope": "openid profile email",
  "user_credential_id": "123",
  "user_id": "456",
  "employee_code": "EMP001",
  "first_name": "John",
  "last_name": "Doe",
  "email": "john@example.com",
  "photograph": "https://...",
  "user_type": "hrs",
  "instance_server_code": "COMPANY_A"
}

Code Examples

cURL


curl -X POST https://auth.humansoft.co.th/oauth2/v1/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "AUTH_CODE_HERE",
    "client_id": "my-app",
    "redirect_uri": "https://myapp.com/callback",
    "code_verifier": "VERIFIER_STRING"
  }'

JavaScript


const response = await fetch('https://auth.humansoft.co.th/oauth2/v1/token', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    grant_type: 'authorization_code',
    code: 'AUTH_CODE_HERE',
    client_id: 'my-app',
    redirect_uri: 'https://myapp.com/callback',
    code_verifier: 'VERIFIER_STRING',
  }),
})
 
const tokens = await response.json()
console.log('Access Token:', tokens.access_token)
console.log('ID Token:', tokens.id_token)
console.log('Refresh Token:', tokens.refresh_token)

Python


import requests
 
url = "https://auth.humansoft.co.th/oauth2/v1/token"
data = {
    "grant_type": "authorization_code",
    "code": "AUTH_CODE_HERE",
    "client_id": "my-app",
    "redirect_uri": "https://myapp.com/callback",
    "code_verifier": "VERIFIER_STRING"
}
 
response = requests.post(url, json=data)
tokens = response.json()
print("Access Token:", tokens["access_token"])

PHP


<?php
$url = "https://auth.humansoft.co.th/oauth2/v1/token";
 
$data = json_encode([
    "grant_type" => "authorization_code",
    "code" => "AUTH_CODE_HERE",
    "client_id" => "my-app",
    "redirect_uri" => "https://myapp.com/callback",
    "code_verifier" => "VERIFIER_STRING"
]);
 
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Content-Type: application/json"
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
 
$response = curl_exec($ch);
$tokens = json_decode($response, true);
 
echo "Access Token: " . $tokens["access_token"];
curl_close($ch);
?>

Grant Type: refresh_token

ใช้ refresh token เพื่อขอ access token ใหม่โดยไม่ต้องให้ user login อีกครั้ง

Refresh token จะถูก rotate ทุกครั้งที่ใช้ — token เก่าจะถูกยกเลิกทันที ต้องใช้ refresh token ใหม่ที่ได้รับจาก response เสมอ

Request Parameters

Parameter	Type	Required	Description
`grant_type`	string	✅	ต้องเป็น `refresh_token`
`refresh_token`	string	✅	Refresh token จาก response ก่อนหน้า
`client_id`	string	✅	Client application ID

Success Response


{
  "token_type": "Bearer",
  "expires_in": 3600,
  "access_token": "NEW_ACCESS_TOKEN",
  "refresh_token": "NEW_REFRESH_TOKEN",
  "scope": "openid profile email"
}

Code Examples

cURL


curl -X POST https://auth.humansoft.co.th/oauth2/v1/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "refresh_token",
    "refresh_token": "REFRESH_TOKEN_STRING",
    "client_id": "my-app"
  }'

JavaScript


const response = await fetch('https://auth.humansoft.co.th/oauth2/v1/token', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    grant_type: 'refresh_token',
    refresh_token: 'REFRESH_TOKEN_STRING',
    client_id: 'my-app',
  }),
})
 
const tokens = await response.json()
// สำคัญ: ต้องใช้ refresh token ใหม่จาก response
console.log('New Access Token:', tokens.access_token)
console.log('New Refresh Token:', tokens.refresh_token)

Python


import requests
 
url = "https://auth.humansoft.co.th/oauth2/v1/token"
data = {
    "grant_type": "refresh_token",
    "refresh_token": "REFRESH_TOKEN_STRING",
    "client_id": "my-app"
}
 
response = requests.post(url, json=data)
tokens = response.json()
# สำคัญ: ต้องใช้ refresh token ใหม่จาก response
print("New Access Token:", tokens["access_token"])
print("New Refresh Token:", tokens["refresh_token"])

PHP


<?php
$url = "https://auth.humansoft.co.th/oauth2/v1/token";
 
$data = json_encode([
    "grant_type" => "refresh_token",
    "refresh_token" => "REFRESH_TOKEN_STRING",
    "client_id" => "my-app"
]);
 
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Content-Type: application/json"
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
 
$response = curl_exec($ch);
$tokens = json_decode($response, true);
 
// สำคัญ: ต้องใช้ refresh token ใหม่จาก response
echo "New Access Token: " . $tokens["access_token"];
echo "New Refresh Token: " . $tokens["refresh_token"];
curl_close($ch);
?>

Grant Type: client_credentials

ขอ access token โดยใช้ client credentials โดยตรง สำหรับ machine-to-machine communication

Request Parameters

Parameter	Type	Required	Description
`grant_type`	string	✅	ต้องเป็น `client_credentials`
`client_id`	string	✅	Client application ID
`client_secret`	string	✅	Client secret

Success Response


{
  "token_type": "Bearer",
  "expires_in": 3600,
  "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjEyMyJ9...",
  "scope": ""
}

Code Examples

cURL


curl -X POST https://auth.humansoft.co.th/oauth2/v1/token \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "my-app",
    "client_secret": "CLIENT_SECRET"
  }'

JavaScript


const response = await fetch('https://auth.humansoft.co.th/oauth2/v1/token', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    grant_type: 'client_credentials',
    client_id: 'my-app',
    client_secret: 'CLIENT_SECRET',
  }),
})
 
const token = await response.json()
console.log('Access Token:', token.access_token)

Python


import requests
 
url = "https://auth.humansoft.co.th/oauth2/v1/token"
data = {
    "grant_type": "client_credentials",
    "client_id": "my-app",
    "client_secret": "CLIENT_SECRET"
}
 
response = requests.post(url, json=data)
token = response.json()
print("Access Token:", token["access_token"])

PHP


<?php
$url = "https://auth.humansoft.co.th/oauth2/v1/token";
 
$data = json_encode([
    "grant_type" => "client_credentials",
    "client_id" => "my-app",
    "client_secret" => "CLIENT_SECRET"
]);
 
$ch = curl_init($url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $data);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Content-Type: application/json"
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
 
$response = curl_exec($ch);
$token = json_decode($response, true);
 
echo "Access Token: " . $token["access_token"];
curl_close($ch);
?>

Error Responses

Common Error Codes

Error Code	HTTP Status	Description
`invalid_request`	400	Missing or invalid parameters
`invalid_client`	401	Client authentication failed
`invalid_grant`	400	Invalid authorization code or refresh token
`unsupported_grant_type`	400	Grant type not supported
`invalid_scope`	400	Requested scope is invalid

Authorization Code Flow - ขอ authorization code (Step 1)
Token Introspection - ตรวจสอบ token
Token Revocation - ยกเลิก token
User Info - ดึงข้อมูล user จาก access token

Token Endpoint

Endpoint

Grant Type: authorization_code

Request Parameters

Success Response

Access Token Payload (decoded)

ID Token Payload (decoded)

Code Examples

cURL

JavaScript

Python

PHP

Grant Type: refresh_token

Request Parameters

Success Response

Code Examples

cURL

JavaScript

Python

PHP

Grant Type: client_credentials

Request Parameters

Success Response

Code Examples

cURL

JavaScript

Python

PHP

Error Responses

Common Error Codes

Related APIs