OAuth2
OAuth2 Authentication
Authorize endpointThe /oauth2/authorize endpoint signs in the user.
GET /oauth2/authorizeThe /oauth2/authorize endpoint only supports HTTPS GET. The client typically makes this request through a browser.
The authorization server requires HTTPS. For more information about the OpenID Connect specification, see Authorization Endpoint.
Request parametersresponse_type (Required)The response type. Must be code.
Token endpointThe /oauth2/token endpoint gets the user's tokens.
POST /oauth2/tokenThe /oauth2/token endpoint only supports HTTPS POST. Your app makes requests to this endpoint directly, not through the user's browser.
For more information about the token endpoint from the OpenID Connect specification, see Token Endpoint.
Request parameters in headerAuthorizationIf the client was issued a secret, the client must pass its client_id and client_secret in the authorization header through Basic HTTP authorization. The authorization header string is Basic Base64Encode(client_id:client_secret). The following example is an authorization header for app client 492e4ec3-fb66-4b45-b529-599c708ec530& with client secret abcdef01234567890, using the Base64-encoded version of the string 492e4ec3-fb66-4b45-b529-599c708ec530&:abcdef01234567890.
UserInfo endpointThe /oauth2/userinfo endpoint returns information about the authenticated user.
GET /oauth2/userinfoThe user pool client makes requests to this endpoint directly and not through a browser.
For more information, see UserInfo Endpoint in the OpenID Connect (OIDC) specification.
Request parameters in headerAuthorization (Required)Pass the access token using the authorization header field.