3.2. 令牌端点(3.2. Token Endpoint)

3.2. 令牌端点

客户端通过提交它的授权许可或刷新令牌使用令牌端点获取访问令牌。令牌端点被用于除了隐式许可类型（因为访问令牌是直接颁发的）外的每种授权许可中。

客户端通过何种方式获得令牌端点的位置超出了本文档范围，但该位置通常在服务文档中提供。

端点URI可以包含“application/x-www-form-urlencoded”格式（按附录B）的查询部分（RFC3986的3.4节），当添加额外的查询参数时必须保留该部分。端点URI不得包含片段部分。

由于向令牌端点的请求引起明文凭据的传输（在HTTP请求和响应中），当向令牌端点发送请求时，授权服务器必须要求如1.6节所述的TLS的使用。

当发起访问令牌请求时，客户端必须使用HTTP“POST”方法。

发送的没有值的参数必须被对待为好像它们在请求中省略了。授权服务器必须忽略不能识别的请求参数。请求和响应参数不能包含超过一次。

 

3.2. Token Endpoint

   The token endpoint is used by the client to obtain an access token by
   presenting its authorization grant or refresh token.  The token
   endpoint is used with every authorization grant except for the
   implicit grant type (since an access token is issued directly).






Hardt                        Standards Track                   [Page 21]

---

 
RFC 6749                        OAuth 2.0                   October 2012


   The means through which the client obtains the location of the token
   endpoint are beyond the scope of this specification, but the location
   is typically provided in the service documentation.

   The endpoint URI MAY include an "application/x-www-form-urlencoded"
   formatted (per Appendix B) query component ([RFC3986] Section 3.4),
   which MUST be retained when adding additional query parameters.  The
   endpoint URI MUST NOT include a fragment component.

   Since requests to the token endpoint result in the transmission of
   clear-text credentials (in the HTTP request and response), the
   authorization server MUST require the use of TLS as described in
   Section 1.6 when sending requests to the token endpoint.

   The client MUST use the HTTP "POST" method when making access token
   requests.

   Parameters sent without a value MUST be treated as if they were
   omitted from the request.  The authorization server MUST ignore
   unrecognized request parameters.  Request and response parameters
   MUST NOT be included more than once.