Password Grant

Use this API to authenticate a given user’s username and password. It makes use of the OpenID password grant and upon success will create a session and return an access token.

Note that the access token returned is different to the access token generated via the OAuth 2.0 Tokens API. Therefore it can not be used to authorize API calls against other endpoints such as Users or Events.

Resource URL

https://<subdomain>.onelogin.com/oidc/2/token

Header Parameter

Authorization

required

string

Set to Basic <base64 encoded "clientId:clientSecret">.

The client_id and client_secret are generated when you configure your OpenId Connect app in OneLogin.

e.g. Using Node.js this would be

new Buffer(`${client_id}:${client_secret}`).toString('base64');

Content-Type

required

string

application/x-www-form-urlencoded

Resource Parameter

subdomain

required

string

Set to the subdomain of your OneLogin instance.

e.g. oidc-sample where the instance is https://oidc-sample.onelogin.com

Request Parameter

grant_type

required

string

Set to "password"

client_id

required

string

The OneLogin generated Client ID for your OpenID Connect app.

username

required

string

The username for a given user

password

required

string

The password for a given user

scope

required

string

Requires at least "openid". Add "profile" and/or "email" to get additional user information returned in the id_token and User Info endpoint.

You must supply the offline_access scope if you wish to obtain a Refresh Token.

resource

string

Optional. When API Authorization is configured, specify the API Resource Identifier here to generate a customized Access Token that can be used for authorizing access to apis and api gateways.

e.g. resource=https://api.example.com/contacts

Sample Request Body

username=rich&password=password&client_id=ba88ac70-1234-0135-527a&grant_type=password&scope=openid
```html

<h2>Sample Response</h2>
<div class="tab-group">
<ul class="tab-links">
<li class="t-link status-200 active" data-tab="1">200 OK</li>
<li class="t-link status-400" data-tab="2">400 Bad Request</li>
<li class="t-link status-401" data-tab="3">401 Unauthorized</li>
</ul>
<div class="tab-views">
<div class="t-view active" data-tab="1">

```json
{
    "access_token": "NWE4Nzg2ZDEtNzQyMS00ZDViLThjMjctMGQwNjlmZjU5MWNkBGjFElT7CWzl0d....",
    "expires_in": 3600,
    "token_type": "Bearer",
    "refresh_token": "897987AGBEtNzQyMS00ZDViLThjMjctMGQwNjlmZjU5MWNkBGjFElT7CWzl0d...."
}

Probably an invalid client_id

{
    "error": "invalid_request",
    "error_description": "Resource not found"
}

The grant_type MUST be set to password

{
    "error": "unsupported_grant_type",
    "error_description": "unsupported grant_type requested (xxxx)"
}

The authorization header is invalid

{
    "error": "invalid_request",
    "error_description": "invalid authorization header value format"
}
{
    "error": "invalid_request",
    "error_description": "Authentication Failed"
}
{
    "error": "invalid_request",
    "error_description": "Authentication Failed: Invalid user credentials"
}
{
    "error": "invalid_request",
    "error_description": "MFA is required for this user"
}
{
    "error": "invalid_request",
    "error_description": "User is locked. Access is unauthorized"
}
{
    "error": "invalid_request",
    "error_description": "User is suspended. Access is unauthorized"
}
{
    "error": "invalid_request",
    "error_description": "Password expired"
}
{
    "error": "invalid_request",
    "error_description": "Access is unauthorized"
}

Response Elements

access_tokenA JSON Web Token (JWT) that represents the session that has just been created for the user.

For example the body of the JWT contains:

{
  "jti": "s0r5Z9z6LTJPs2xP2sipi",
  "iss": "https://acme.onelogin.com/oidc/2",
  "iat": 1534812736,
  "exp": 1534813336,
  "aud": "9a6d6350-2af8-0136-197b-06acc76d34b492920"
}
expires_inThe number of seconds until the session expires. This timeout can be configured by setting the Access Token Timeout period in your OpenId Connect app via the OneLogin portal.
token_typeThe type of access token. Always set to "Bearer"
refresh_tokenOnly returned if a Refresh Token Timeout period has specified in your OpenId Connect app settings via the OneLogin portal.

Sample Code

cURL

Replace sample values indicated by < > with your actual values.

curl -XPOST "https://<subdomain>.onelogin.com/oidc/2/token" \
-H "Authorization: Basic <base64 encoded client_id:client_secret>" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=password&username=<username>&password=<password>&client_id=<client_id>&scope=openid"

Postman Collection

Run In Postman