Redeem a pre-authorized-code for an access token

POST

/oid4vci/token

curl --request POST \
  --url https://example.com/oid4vci/token \
  --header 'Content-Type: application/json' \
  --data '{ "grant_type": "urn:ietf:params:oauth:grant-type:pre-authorized_code", "pre-authorized_code": "example", "tx_code": "example" }'

Public and unauthenticated OID4VCI token endpoint for the pre-authorized-code grant. Accepts only grant_type=urn:ietf:params:oauth:grant-type:pre-authorized_code with a valid, unexpired, single-use pre-authorized_code. A matching tx_code is required when the credential offer includes a tx_code object. Mints a short-TTL Notary-signed access token plus a c_nonce. Returns 404 when the pre-authorized-code flow is disabled. Error responses use the OpenID4VCI error envelope, not RFC 9457 Problem Details.

Request Body^required

object

grant_type

required

string

Example

urn:ietf:params:oauth:grant-type:pre-authorized_code

pre-authorized_code

required

string

tx_code

The numeric PIN shown on the offer page. Required when the credential offer includes a tx_code object.

string

object

grant_type

required

string

Example

urn:ietf:params:oauth:grant-type:pre-authorized_code

pre-authorized_code

required

string

tx_code

The numeric PIN shown on the offer page. Required when the credential offer includes a tx_code object.

string

Responses

200

Token response

Media typeapplication/json

object

access_token

required

string

c_nonce

string

c_nonce_expires_in

integer format: uint64

expires_in

integer format: uint64

token_type

required

string

Example

{
  "access_token": "eyJhbGciOiJFZERTQSIsInR5cCI6InJlZ2lzdHJ5LW5vdGFyeS1hY2Nlc3MrancifQ.payload.signature",
  "c_nonce": "b64url-nonce",
  "c_nonce_expires_in": 300,
  "expires_in": 300,
  "token_type": "Bearer"
}

400

Invalid request, grant, or tx_code

Media typeapplication/json

object

error

required

string

error_description

string

Example

{
  "error": "invalid_grant",
  "error_description": "pre-authorized code or tx_code is invalid"
}

404

Pre-authorized-code flow is disabled

429

Too many token attempts (wrong-PIN lockout or random-code flood)

Media typeapplication/json

object

error

required

string

error_description

string

Example

{
  "error": "slow_down",
  "error_description": "too many token requests"
}

500

Token issuance failed

Media typeapplication/json

object

error

required

string

error_description

string

Example

{
  "error": "server_error",
  "error_description": "token issuance failed"
}