Method: common.token

Exchanges a credential for a Google-generated OAuth 2.0 access token or refreshes an access token following the OAuth 2.0 Authorization Framework.

This endpoint supports Google Cloud's unified OAuth flow, accommodating both federated users (for example, from Workforce Identity Federation) and Google Accounts for accessing Google Cloud resources.

The provided credential can be: - An authorization code issued by Google Cloud's unified authorization endpoint. - A refresh token previously issued by this token endpoint.

HTTP request

POST https://cloudoauth.googleapis.com/v1/common/token

The URL uses gRPC Transcoding syntax.

Request body

The request body contains data with the following structure:

JSON representation 
{
  "grantType": string,
  "scope": string,
  "clientId": string,
  "redirectUri": string,
  "codeVerifier": string,
  "code": string,
  "refreshToken": string,
  "clientSecret": string,
  "parent": string
}
Fields
grantType

string

Required. The grant types are as follows:

  • authorization_code : an authorization code flow, for example, exchange of authorization code for the OAuth access token

  • refreshToken : a refresh token flow, for example, obtain a new access token by providing the refresh token. See Grant Type
scope

string

Optional. A list of scopes that are requested for the token to be returned. See Scope. Must be a list of space-delimited, case-sensitive strings. Note: Currently, specifying scopes in the request is not supported.
clientId

string

Optional. The client identifier for the OAuth 2.0 client that requested the provided token. It is required when the client is not authenticating with the authorization server, for example, when authentication method is client authentication.
redirectUri

string

Optional. The redirect URI. Required if grantType is authorization_code. See Redirect URI
codeVerifier

string

Optional. The code verifier for the PKCE request. Application (Client) originally generates it before the authorization request. PKCE is used to protect authorization code from interception attacks. See PKCE and PKCE. Required if grantType is authorization_code.
code

string

Optional. The authorization code that was previously obtained from Google Cloud's unified authorization endpoint. Required if the flow is authorization code flow, for example, if grantType is authorization_code.
refreshToken

string

Optional. Credential used to obtain a new access token when the current access token becomes invalid or expires. Required when using refresh token flow, for example, if grantType is refreshToken. See Refresh Token Grant and Refresh Token
clientSecret

string

Optional. To use a client secret for client authentication in the request-body, the client uses the clientSecret parameter. Otherwise, leave this parameter unset to use HTTP Basic authentication.

Note: According to the RFC, the client must not use more than one authentication method for any given request; using both will result in an error. Also, it is recommended to use the HTTP Basic authentication scheme instead of this parameter, if feasible.

For more information, see https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1
parent

string

Optional. The resource name of the parent organization. Format: organizations/{organization_id} This field is populated only for tenant-specific token requests.

Response body

If successful, the response body contains an instance of ExchangeTokenResponse.