oidc-token-endpoint

To implement an OpenID Connect token endpoint for Basic OP certification, configure a TLS-only HTTPS POST endpoint handling authorization_code flow exchanges, client_secret_basic or client_secret_post authentication, and standard token response formatting as specified by OpenID Connect Core sections 3.1.3 and 9.

OIDC token endpoint client authentication requires either client_secret_basic or client_secret_post methods. Both methods validate the client credentials during the HTTP POST token request to ensure secure authorization_code exchange before issuing access tokens and id_tokens.

The authorization_code flow exchange at the OAuth2 token endpoint validates the submitted code and redirect_uri via HTTP POST, authenticates the client, and prevents code reuse by issuing a formatted token response containing the access_token and id_token.

OpenID Connect token endpoints require TLS enforcement to prevent credential leakage and interception during client_secret transmission. The HTTPS-only constraint ensures secure HTTP POST handling and protects the authorization_code exchange process from unauthorized access.

Security checks to prevent authorization code reuse in OIDC include validating the code's single-use status, verifying the redirect_uri matches the initial request, and enforcing comprehensive error handling for invalid or expired code submissions at the token endpoint.

Yes, you can use client_secret_post instead of client_secret_basic for OpenID Connect token requests. The token endpoint accepts both authentication methods, allowing you to pass client credentials in the HTTP POST body rather than the Authorization header.