tencent cloud

Tencent OneID Identity Security

문서Tencent OneID Identity Security

Username and Password Authentication

Download
포커스 모드
폰트 크기
마지막 업데이트 시간: 2026-08-26 15:38:13
AI 번역

API Description

Verify the user's username and password, obtain the Access Token and ID Token, and complete the login. This API corresponds to the Resource Owner Password Credentials mode of the OAuth 2.0 protocol.
Note:
Because user passwords will be transmitted between the user's device and the application, you must use a highly trusted application to call this API and properly handle password transmission (for example, ensure that HTTPS is used). When conditions permit, we recommend using authentication portal login as the first choice.

Supported Application Types

Web applications, single-page applications, and mobile apps.

Request Method

POST

Request path

/oauth2/token

Request Content-Type

application/x-www-form-urlencoded

Request Example

POST /oauth2/token HTTP/1.1
Host: sample.portal.tencentciam.com
Content-Type: application/x-www-form-urlencoded
grant_type=password&client_id=TENANT_CLIENT_ID&client_secret=TENANT_CLIENT_SECRET&auth_source_id=MOCK_USERNAME_PASSWORD_AUTH_SOURCE_ID&username=MOCK_USERNAME&password=MOCK_PASSWORD&scope=openid

Request Parameters

Parameter
No
Description
grant_type
false
Enter the fixed value password.
client_id
false
The application's client_id. You can refer to the "Client Id" on the Application Management page > Select the specified application > Click Application Configuration > the corresponding "Client Id".
client_secret
true
The client_secret of the application. You can refer to the corresponding "client_secret" on the Application Management page > Select the specified application > Application Configuration > the corresponding "client_secret".
Web applications must pass this parameter.
Single-page applications and mobile apps do not pass this parameter.
auth_source_id
false
The username/password authentication source ID. You can view it on the General Authentication Sources page in the console.
username
false
Username. You must use the authentication source attributes configured for the username/password authentication source, such as username, phone number, or email address.
password
false
User password.
scope
true
This parameter is optional. If you pass it, enter the fixed value openid.

Normal Response Example

Verification succeeded

HTTP/1.1 200 OK
Content-Type: application/json;charset=UTF-8

{
  "access_token" : "eyJraWQiOiI1MzQyOGU3ZS1kOTJiLTQ3OTAtOGIwMC0wMmEyZjc4NjUxNzMiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJNT0NLX1VTRVJfSUQiLCJhdWQiOiJURU5BTlRfQ0xJRU5UX0lEIiwibmJmIjoxNjQwNTg4ODI2LCJzY29wZSI6WyJvcGVuaWQiXSwiaXNzIjoiaHR0cHM6XC9cL3NhbXBsZS5wb3J0YWwudGVuY2VudGNpYW0uY29tIiwiZXhwIjoxNjQwNTg5MTI2LCJpYXQiOjE2NDA1ODg4MjYsImp0aSI6IjU0ODZhNWRhLTE0YTYtNDNkZC04MWNkLTEwNmRiMDVhMjJmZiJ9.cd2hoQEVZLGcRaqhDLs-W8m9IN2pDT4XzluxYz4ulNwHTfBTu_1NamlH0kmd0KDhzBMRAl6YXHVDVOXZEV47C1uoYDATnwQetUsg8eJObzlPEVZ81ovU-eRm7I0lQ_MVI9MC7jMcdOKvEDJCOJtnwtorkQpqEPYovrxctNvvClqLBsDVbUebC2-iUGwz4vWE-DL17M39rqtmwXv6C21ovv6Pe9BSUUAj_CzHSV-ZSF7fjyYjnlTEOLjilFNsFD9Ow1czNFqnwxkc7dwugOGJ7qM30zuTgSme76K3tLbol8fKO-CUKglZO9mWIXUWizhePTzd3CKGE4C7gUHR40EjNw",
  "refresh_token" : "7uqTlthTQrzIZx8joT20chQbakZp81_iv39GTyCpsEyYpWoquNhuB3s6qEQHGeu2RBpaZcavFf9UOdgtUaCjB42D478MISnj6qBY52q3Pd5eNBBcXZ68oqMkFVidvgha",
  "scope" : "openid",
  "id_token" : "eyJraWQiOiI1MzQyOGU3ZS1kOTJiLTQ3OTAtOGIwMC0wMmEyZjc4NjUxNzMiLCJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJNT0NLX1VTRVJfSUQiLCJhdWQiOiJURU5BTlRfQ0xJRU5UX0lEIiwiYXpwIjoiVEVOQU5UX0NMSUVOVF9JRCIsImlzcyI6Imh0dHBzOlwvXC9zYW1wbGUucG9ydGFsLnRlbmNlbnRjaWFtLmNvbSIsImV4cCI6MTY0MDU5MDYyNiwiaWF0IjoxNjQwNTg4ODI2LCJqdGkiOiI0Mzg0OTUwYS0zOTFlLTQ3MDgtYjFjYS05ZjVkNzQzN2Q3ZDIifQ.kaquINkB64dRAaXPG8KLBCpZ6hwNxtA5ruXpwYgEzFHppXQMqPRQQ-Iwn0659lpy8B2CqjRIar_A1xS518Uua3ItkUtoJQXcIxLDSGRatk6mZ6q7XgOHvALsLhQlYQjn36kXdnOJipPVB124y-o20UHwUC27nUH0e9GuYxwX3p56684NB4xJXUfEL2yl9Zt8rMEpD1I1hI5exg75ZP7MCSjzoNgr7fmpGuDNWWhRALh6sY4Dv5BSgE9B0No0xwFOLnAV4NMsvimJg5rBlJXepOhW4JfwZ3TnzXtDUk3oeajhRxPtjbkxt5NrSYMxUwBggkcoi4eOfVpo8crmQNrSVQ",
  "token_type" : "Bearer",
  "expires_in" : 299
}

Response Parameters

Parameter
Data Type
Description
access_token
String
OAuth 2.0 Access Token (JWT).
token_type
String
The Token type. Currently, the fixed value Bearer is returned.
expires_in
Number
The validity period of the Access Token, in seconds.
scope
String
Access Token scope.
refresh_token
String
OAuth 2.0 Refresh Token.
id_token
String
OIDC ID Token (JWT).

Exception Response Example

The username or password is incorrect.
HTTP/1.1 400 Bad Request
Content-Type: application/json;charset=UTF-8

{
"error" : "invalid_grant",
"error_description" : "Wrong username or password"
}
The user status is abnormal (for example, the account is locked or frozen).
HTTP/1.1 400 Bad Request
Content-Type: application/json;charset=UTF-8

{
"error" : "invalid_grant",
"error_description" : "Abnormal user status"
}
An attribute not supported by the authentication source is used as the username (for example, an email address is passed for the username parameter, but the username/password authentication source is not configured with the email address as an authentication source attribute).
HTTP/1.1 400 Bad Request
Content-Type: application/json;charset=UTF-8

{
"error" : "invalid_grant",
"error_description" : "Unsupported username identifier"
}
The authentication source is not the application's primary or associated authentication source.
HTTP/1.1 400 Bad Request
Content-Type: application/json;charset=UTF-8

{
"error" : "invalid_auth_source",
"error_description" : "Auth source and application not associated"
}

다음 주제: 개인 정보 보호 정책

도움말 및 지원

문제 해결에 도움이 되었나요?

피드백