Mock OAuth Token API Response

OAuth 2.0 Token Response

The OAuth token endpoint response is a critical part of any authentication flow. This mock generates a realistic token response following the OAuth 2.0 RFC 6749 specification.

Response Structure

{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "dGhpcyBpcyBhIHJlZnJlc2ggdG9rZW4...",
  "scope": "read write profile"
}

Field Descriptions

Field	Required	Description
access_token	Yes	The token used to authenticate API requests
token_type	Yes	Almost always "Bearer"
expires_in	Recommended	Lifetime in seconds
refresh_token	Optional	Used to obtain a new access token
scope	Conditional	Space-separated list of granted scopes

Token Lifecycle

1. Client requests token from /oauth/token with credentials
2. Server returns access token and refresh token
3. Client uses access token in Authorization: Bearer <token> header
4. When access token expires, client uses refresh token to get a new one
5. If refresh token is revoked or expired, user must re-authenticate

Testing Auth Flows

This mock is useful for testing:

• Token storage (secure HTTP-only cookies vs localStorage)
• Automatic token refresh before expiry
• Handling expired tokens (401 response)
• Scope-based feature toggling in the UI