# How to get idToken or accessToken via the API? **URL:** \ **Category:** OAuth/OIDC\ **Created:** [February 16, 2024, 3:14pm UTC](https://devforum.okta.com/t/how-to-get-idtoken-or-accesstoken-via-the-api/26854 "2024-02-16T15:14:25Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![kaizad](https://avatars.discourse-cdn.com/v4/letter/k/e47c2d/32.png) [@kaizad](https://devforum.okta.com/u/kaizad)\ **Post date:** [February 16, 2024, 3:14pm UTC](https://devforum.okta.com/t/how-to-get-idtoken-or-accesstoken-via-the-api/26854/1 "2024-02-16T15:14:25Z")
Essentially the question. I would like to get a user’s tokens via API calls, not by actually logging in with the browser. I have tried calling the `/api/v1/authn` API, which gives me the sessionToken, but when I try to exchange it for an idToken or accessToken through the `/v1/authorize` API, I get a 403 error when I use Postman, but it works with the callback URL when I use the browser. ---
**Author:** ![peteOKTALetkeman](https://avatars.discourse-cdn.com/v4/letter/p/76d3ee/32.png) [@peteOKTALetkeman](https://devforum.okta.com/u/peteOKTALetkeman)\ **Post date:** [February 17, 2024, 7:32pm UTC](https://devforum.okta.com/t/how-to-get-idtoken-or-accesstoken-via-the-api/26854/2 "2024-02-17T19:32:27Z")
Maybe this helps. - What flow method(s) are you using? - Have you see this [Set up OAuth 2.0 On-Behalf-Of Token Exchange | Okta Developer](https://developer.okta.com/docs/guides/set-up-token-exchange/main/)? - Which programming language are you using? Here is an example in Python which exchanges the token, which can be found here > **[Sign users in to your web app using the redirect model | Okta Developer](https://developer.okta.com/docs/guides/sign-into-web-app-redirect/python/main/)** > > Secure, scalable, and highly available authentication and user management for any app. ```auto query_params = requests.compat.urlencode(query_params) exchange = requests.post( config["token_uri"], headers=headers, data=query_params, auth=(config["client_id"], config["client_secret"]), ).json() # Get tokens and validate if not exchange.get("token_type"): return "Unsupported token type. Should be 'Bearer'.", 403 access_token = exchange["access_token"] id_token = exchange["id_token"] ``` This is about as much as I can help you as I’m no expert. But answering those questions will help anyone better understand your situation. ---
**Author:** ![kaizad](https://avatars.discourse-cdn.com/v4/letter/k/e47c2d/32.png) [@kaizad](https://devforum.okta.com/u/kaizad)\ **Post date:** [February 18, 2024, 12:28pm UTC](https://devforum.okta.com/t/how-to-get-idtoken-or-accesstoken-via-the-api/26854/3 "2024-02-18T12:28:19Z")
Thank you for your response! I am not sure which flow methods I’m using. I’ve not seen that. I’m using Python, though Javascript examples are also acceptable since I have a SPA that needs it too. The main thing with this example is that it still uses the redirect to get the “code” first, and then exchanges that with the OIDC tokens (see below screenshot of the example). I would like to be able to do all of it without this redirect in the first place, just through API calls ideally. ![image](https://global.discourse-cdn.com/oktadev/original/2X/a/ac1a32878762d676a24007c2e0fae919bbe54942.png) ---
**Author:** ![peteOKTALetkeman](https://avatars.discourse-cdn.com/v4/letter/p/76d3ee/32.png) [@peteOKTALetkeman](https://devforum.okta.com/u/peteOKTALetkeman)\ **Post date:** [February 18, 2024, 2:33pm UTC](https://devforum.okta.com/t/how-to-get-idtoken-or-accesstoken-via-the-api/26854/4 "2024-02-18T14:33:44Z")
Okay, looks like you may want to look at the JavaScript QuickStart guides found here [Quickstart | Okta Developer](https://developer.okta.com/docs/guides/quickstart/main/#front-end-web-app) which all talk about SPA sites and the Redirect Model. They all use one or more OKTA JavaScript library. **However** , before that I suggest that you read this page [OAuth 2.0 and OpenID Connect overview | Okta Developer](https://developer.okta.com/docs/concepts/oauth-openid/) **especially** ‘what-kind-of-client-are-you-building’ - [OAuth 2.0 and OpenID Connect overview | Okta Developer](https://developer.okta.com/docs/concepts/oauth-openid/#what-kind-of-client-are-you-building). The screen shot that you have provided is for the Redirect Model with Authorization Code flow with PKCE (using Python), not to be confused with Authorization Code flow (using Python) and these two are different. I did confuse the two and ended up wasting a lot of time. Also note that some flows provide an ID Token and Access Token, while others only provide an Access Token. In the end, what helped me the most is getting the QuickStart working by itself and then copying the parts I needed to my real application. ---
**Author:** ![peteOKTALetkeman](https://avatars.discourse-cdn.com/v4/letter/p/76d3ee/32.png) [@peteOKTALetkeman](https://devforum.okta.com/u/peteOKTALetkeman)\ **Post date:** [February 18, 2024, 7:45pm UTC](https://devforum.okta.com/t/how-to-get-idtoken-or-accesstoken-via-the-api/26854/5 "2024-02-18T19:45:42Z")
You may want to also checkout out the list of endpoints available to you by going to https://{oktaDomain}/oauth2/default/.well-known/oauth-authorization-server ---
**Author:** ![kaizad](https://avatars.discourse-cdn.com/v4/letter/k/e47c2d/32.png) [@kaizad](https://devforum.okta.com/u/kaizad)\ **Post date:** [February 19, 2024, 3:41pm UTC](https://devforum.okta.com/t/how-to-get-idtoken-or-accesstoken-via-the-api/26854/6 "2024-02-19T15:41:03Z")
Thank you so much Pete! This helped a lot! I was actually looking for the `/token` route, as described [here](https://developer.okta.com/docs/reference/api/oidc/#token). The last link you sent was instrumental to finding what I wanted. What I needed was the [resource owner password flow](https://developer.okta.com/docs/guides/implement-grant-type/ropassword/main/). This allows me to submit the username and password in exchange for the idToken and accessToken. ---
**Author:** ![peteOKTALetkeman](https://avatars.discourse-cdn.com/v4/letter/p/76d3ee/32.png) [@peteOKTALetkeman](https://devforum.okta.com/u/peteOKTALetkeman)\ **Post date:** [February 19, 2024, 6:42pm UTC](https://devforum.okta.com/t/how-to-get-idtoken-or-accesstoken-via-the-api/26854/7 "2024-02-19T18:42:33Z")
It’s great that you are on your way to a solution and I was glad that I was able to help. I hope that you saw this '_ **About the Resource Owner Password grant** _ The Resource Owner Password flow **isn’t a recommended approach**. It’s intended for applications for which no other flow works, as it requires your application code to be fully trusted and protected from credential-stealing attacks. It’s made available primarily to provide a consistent and predictable integration pattern for legacy applications that can’t otherwise be updated to a more secure flow such as the Authorization Code flow. This should be your last option, not your first choice.’ Seeing as what you are creating is something new, maybe you should not use the Resource Owner Password flow. ---
**Author:** ![kaizad](https://avatars.discourse-cdn.com/v4/letter/k/e47c2d/32.png) [@kaizad](https://devforum.okta.com/u/kaizad)\ **Post date:** [February 20, 2024, 8:59am UTC](https://devforum.okta.com/t/how-to-get-idtoken-or-accesstoken-via-the-api/26854/8 "2024-02-20T08:59:01Z")
Hi Pete! Thank you for your responses, they are always insightful, and this is definitely something I will keep in mind. Maybe I should have provided context on my case. The purpose of this question is not for a public-facing web app. Rather, it is for a tool used by internal/private stakeholders who are technical (ie. know how to code) but don’t necessarily have extensive knowledge on software development practices, such as scientists and engineers. On another note, the python code I made for this is shown below: ```python import os import requests from base64 import b64encode def authenticate(username, password): url = os.environ['OKTA_ORG_URL'] + '/oauth2/v1/token' payload = requests.compat.urlencode({ 'grant_type': 'password', 'scope': 'openid', 'username': username, 'password': password }) auth = f"{os.environ['OKTA_CLIENT_ID']}:{os.environ['OKTA_CLIENT_SECRET']}" headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'Authorization': 'Basic ' + b64encode(auth.encode()).decode() } response = requests.request("POST", url, headers=headers, data=payload) return response.json() ``` ---
**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\ **Post date:** [February 21, 2024, 8:59am UTC](https://devforum.okta.com/t/how-to-get-idtoken-or-accesstoken-via-the-api/26854/9 "2024-02-21T08:59:17Z")
This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.