Token responses and failures
08A successful token response describes the credential. An error response must not be mistaken for one.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
DIAGRAM§ 5 ↗
RFC 6749 · § 5EXAMPLE
3 / 3
03
Return a defined error instead.
A rejected grant must not be processed as a successful authorization.
Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
Read the updated RFC section ↗
Parse success and failure deliberately.
- Success includes access_token and token_type; expires_in is recommended, and scope is returned when it differs from the request.
- Token responses containing credentials use Cache-Control: no-store and Pragma: no-cache.
- Errors include invalid_request, invalid_client, invalid_grant, unauthorized_client, unsupported_grant_type, and invalid_scope.
OAuth does not mandate one universal access-token serialization. The token type determines how it is used.
Read the RFC section ↗Diagrams simplify the RFC. Read the linked sections for complete requirements.
PrivacyAll chapters in this RFC
- Four roles, one delegation
- Public and confidential clients
- Two endpoints, two channels
- Authorization code grant
- Implicit grant: historical behavior
- Password grant: now prohibited
- Client credentials and extension grants
- Token responses and failures
- Refresh without another prompt
- Scope and protected resources
- Native apps and security boundaries