Password Grant

Deprecation Notice

There is a more recent version of this OpenId Connect API available. Learn more.

This endpoint will be removed from service on April 20th 2021.

Use this API to authenticate a given user’s username and password. It makes use of the OpenID password grant and upon success will create a session and return an access token.

Note that the access token returned is different to the access token generated via the OAuth 2.0 Tokens API. Therefore it can not be used to authorize API calls against other endpoints such as Users or Events.

Resource URL

https://<region>.onelogin.com/oidc/token

Header Parameter

new Buffer(`${client_id}:${client_secret}`).toString('base64');

Resource Parameter

Request Parameter

Sample Request Body

username=rich&password=password&client_id=ba88ac70-1234-0135-527a&grant_type=password&scope=openid

Sample Response

{
    "access_token": "NWE4Nzg2ZDEtNzQyMS00ZDViLThjMjctMGQwNjlmZjU5MWNkBGjFElT7CWzl0d....",
    "expires_in": 3600,
    "token_type": "Bearer",
    "refresh_token": "897987AGBEtNzQyMS00ZDViLThjMjctMGQwNjlmZjU5MWNkBGjFElT7CWzl0d...."
}

{
    "error": "invalid_request",
    "error_description": "Resource not found"
}

{
    "error": "unsupported_grant_type",
    "error_description": "unsupported grant_type requested (xxxx)"
}

{
    "error": "invalid_request",
    "error_description": "invalid authorization header value format"
}

{
    "error": "invalid_request",
    "error_description": "Authentication Failed"
}

{
    "error": "invalid_request",
    "error_description": "Authentication Failed: Invalid user credentials"
}

{
    "error": "invalid_request",
    "error_description": "MFA is required for this user"
}

{
    "error": "invalid_request",
    "error_description": "User is locked. Access is unauthorized"
}

{
    "error": "invalid_request",
    "error_description": "User is suspended. Access is unauthorized"
}

{
    "error": "invalid_request",
    "error_description": "Password expired"
}

{
    "error": "invalid_request",
    "error_description": "Access is unauthorized"
}

Response Elements

Sample Code

cURL

Replace sample values indicated by < > with your actual values.

curl -XPOST "https://<region>.onelogin.com/oidc/token" \
-H "Authorization: Basic <base64 encoded client_id:client_secret>" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=password&username=<username>&password=<password>&client_id=<client_id>&scope=openid"

Postman Collection