Resource Owner (Legacy)

curl --request POST \ --url https://{yourDomain}/oauth/ro \ --header 'Authorization: Bearer <token>' \ --header 'Content-Type: application/json' \ --data ' { "client_id": "<string>", "username": "<string>", "password": "<string>", "connection": "<string>", "grant_type": "password", "scope": "<string>", "id_token": "<string>", "device": "<string>" } '

{ "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyMzQ1In0...", "token_type": "Bearer", "expires_in": 86400, "refresh_token": "v1.MRHbz1VqR_y42v...", "id_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...", "scope": "openid profile email" }

Authorizations

Authorization

string

header

required

The access token received from the authorization server in the OAuth 2.0 flow.

Body

application/json

client_id

string

required

Your application's Client ID

username

string

required

The user's username or email

password

string

required

The user's password

connection

string

required

The name of the database connection

grant_type

enum<string>

required

Must be 'password'

Available options:

password

scope

string

Space-delimited list of requested scopes

id_token

string

Used for delegation flows

device

string

Device identifier

Response

Successful authentication

Successful token response containing access token and optionally ID token and refresh token

access_token

string

required

The access token issued by the authorization server. Use this token to access protected resources (APIs).

Example:

"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6IjEyMzQ1In0..."

token_type

enum<string>

required

The type of the token issued. Always 'Bearer' for Auth0.

Available options:

Bearer

Example:

"Bearer"

expires_in

integer

required

The lifetime in seconds of the access token. After this time, the token will expire and can no longer be used.

Example:

86400

refresh_token

string

The refresh token which can be used to obtain new access tokens. Only returned if 'offline_access' scope was requested.

Example:

"v1.MRHbz1VqR_y42v..."

id_token

string

The ID Token containing user profile information. Only returned if 'openid' scope was requested. This is a JWT containing user claims.

Example:

"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."

scope

string

The scopes granted by the authorization server. May differ from requested scopes.

Example:

"openid profile email"