curl --request POST \
--url https://prod-auth.tktchurch.com/oauth/token \
--header 'Authorization: Basic <encoded-value>' \
--header 'Content-Type: application/json' \
--data '
{
"grant_type": "password",
"client_id": "dev-console"
}
'{
"access_token": "eyJhbGciOiJFUzI1NiIsImtpZCI6IjAyMDI2MDkyMiJ9.eyJzdWIiOiJ1c2VyX2EwMSIsIm9yZ19pZCI6Im9yZ19lMDIiLCJjbGllbnRfaWQiOiJkZXYtY29uc29sZSIsInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwgb2ZmbGluZV9hY2Nlc3MiLCJleHAiOjE3OTg3NjQwMDB9.c2lnbmF0dXJl",
"token_type": "Bearer",
"expires_in": 3600,
"refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbl9pZCI6InRva19iazAxIiwiZXhwIjoxODAxNjk2MDAwfQ.c2lnbmF0dXJl",
"scope": "openid profile email offline_access",
"id_token": "eyJhbGciOiJFUzI1NiJ9.eyJzdWIiOiJ1c2VyX2EwMSIsImF1ZCI6ImRldi1jb25zb2xlIiwiZXhwIjoxNzk4NzY0MDAwfQ.c2lnbmF0dXJl"
}Token endpoint (all grants)
authorization_code (PKCE verifier required, single-use code) | refresh_token (rotates — a stale token returns invalid_grant and revokes the session) | password (first-party dev only, org-scoped; 401 mfa_required when enrolled) | client_credentials (M2M, access token only) | device_code (poll) | token-exchange (guardian with guardian:act_as scope to a minor, consent-checked).
POST
/
oauth
/
token
curl --request POST \
--url https://prod-auth.tktchurch.com/oauth/token \
--header 'Authorization: Basic <encoded-value>' \
--header 'Content-Type: application/json' \
--data '
{
"grant_type": "password",
"client_id": "dev-console"
}
'{
"access_token": "eyJhbGciOiJFUzI1NiIsImtpZCI6IjAyMDI2MDkyMiJ9.eyJzdWIiOiJ1c2VyX2EwMSIsIm9yZ19pZCI6Im9yZ19lMDIiLCJjbGllbnRfaWQiOiJkZXYtY29uc29sZSIsInNjb3BlIjoib3BlbmlkIHByb2ZpbGUgZW1haWwgb2ZmbGluZV9hY2Nlc3MiLCJleHAiOjE3OTg3NjQwMDB9.c2lnbmF0dXJl",
"token_type": "Bearer",
"expires_in": 3600,
"refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0b2tlbl9pZCI6InRva19iazAxIiwiZXhwIjoxODAxNjk2MDAwfQ.c2lnbmF0dXJl",
"scope": "openid profile email offline_access",
"id_token": "eyJhbGciOiJFUzI1NiJ9.eyJzdWIiOiJ1c2VyX2EwMSIsImF1ZCI6ImRldi1jb25zb2xlIiwiZXhwIjoxNzk4NzY0MDAwfQ.c2lnbmF0dXJl"
}Authorizations
Basic authentication header of the form Basic <encoded-value>, where <encoded-value> is the base64-encoded string username:password.
Body
application/json
Available options:
authorization_code, refresh_token, password, client_credentials, urn:ietf:params:oauth:grant-type:device_code, urn:ietf:params:oauth:grant-type:token-exchange Example:
"password"
Example:
"dev-console"
Example:
6-digit TOTP when MFA is enrolled
Example:
"openid profile email offline_access"
Guardian access token (token-exchange)
Minor user id (token-exchange)
RFC 8707 indicator
RFC 9396 JSON array (string-encoded)