CreateOAuth2Token

$result = $client->createOAuth2Token([/* ... */]);
$promise = $client->createOAuth2TokenAsync([/* ... */]);

CreateOAuth2Token API

Path: /v1/token Request Method: POST Content-Type: application/json or application/x-www-form-urlencoded

This API implements OAuth 2.0 flows for AWS Sign-In CLI clients, supporting both:

1. Authorization code redemption (grant_type=authorization_code) - NOT idempotent
2. Token refresh (grant_type=refresh_token) - Idempotent within token validity window

The operation behavior is determined by the grant_type parameter in the request body:

Authorization Code Flow (NOT Idempotent):

• JSON or form-encoded body with client_id, grant_type=authorization_code, code, redirect_uri, code_verifier
• Returns access_token, token_type, expires_in, refresh_token, and id_token
• Each authorization code can only be used ONCE for security (prevents replay attacks)

Token Refresh Flow (Idempotent):

• JSON or form-encoded body with client_id, grant_type=refresh_token, refresh_token
• Returns access_token, token_type, expires_in, and refresh_token (no id_token)
• Multiple calls with same refresh_token return consistent results within validity window

Authentication and authorization:

• Confidential clients: sigv4 signing required with signin:ExchangeToken permissions
• CLI clients (public): authn/authz skipped based on client_id & grant_type

Note: This operation cannot be marked as @idempotent because it handles both idempotent (token refresh) and non-idempotent (auth code redemption) flows in a single endpoint.

Parameter Syntax

$result = $client->createOAuth2Token([
    'tokenInput' => [ // REQUIRED
        'clientId' => '<string>', // REQUIRED
        'code' => '<string>',
        'codeVerifier' => '<string>',
        'grantType' => '<string>', // REQUIRED
        'redirectUri' => '<string>',
        'refreshToken' => '<string>',
    ],
]);

Parameter Details

Result Syntax

[
    'tokenOutput' => [
        'accessToken' => [
            'accessKeyId' => '<string>',
            'secretAccessKey' => '<string>',
            'sessionToken' => '<string>',
        ],
        'expiresIn' => <integer>,
        'idToken' => '<string>',
        'refreshToken' => '<string>',
        'tokenType' => '<string>',
    ],
]

Result Details

Errors

TooManyRequestsError:

Error thrown when rate limit is exceeded

HTTP Status Code: 429 Too Many Requests

Possible OAuth2ErrorCode values:

• INVALID_REQUEST: Rate limiting, too many requests, abuse prevention

Possible causes:

• Too many token requests from the same client
• Rate limiting based on client_id or IP address
• Abuse prevention mechanisms triggered
• Service protection against excessive token generation

InternalServerException:

Error thrown when an internal server error occurs

HTTP Status Code: 500 Internal Server Error

Used for unexpected server-side errors that prevent request processing.

ValidationException:

Error thrown when request validation fails

HTTP Status Code: 400 Bad Request

Used for request validation errors such as malformed parameters, missing required fields, or invalid parameter values.

AccessDeniedException:

Error thrown for access denied scenarios with flexible HTTP status mapping

Runtime HTTP Status Code Mapping:

• HTTP 401 (Unauthorized): TOKEN_EXPIRED, AUTHCODE_EXPIRED
• HTTP 403 (Forbidden): USER_CREDENTIALS_CHANGED, INSUFFICIENT_PERMISSIONS

The specific HTTP status code is determined at runtime based on the error enum value. Consumers should use the error field to determine the specific access denial reason.

CreateOAuth2TokenWithIAM

$result = $client->createOAuth2TokenWithIAM([/* ... */]);
$promise = $client->createOAuth2TokenWithIAMAsync([/* ... */]);

Grants permission to exchange client credentials for an OAuth 2.0 access token scoped to a resource that can be used to access AWS services from applications

Parameter Syntax

$result = $client->createOAuth2TokenWithIAM([
    'grantType' => '<string>', // REQUIRED
    'resource' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'accessToken' => '<string>',
    'expiresIn' => <integer>,
    'tokenType' => '<string>',
]

Result Details

Errors

TooManyRequestsError:

Error thrown when rate limit is exceeded

HTTP Status Code: 429 Too Many Requests

Possible OAuth2ErrorCode values:

• INVALID_REQUEST: Rate limiting, too many requests, abuse prevention

Possible causes:

• Too many token requests from the same client
• Rate limiting based on client_id or IP address
• Abuse prevention mechanisms triggered
• Service protection against excessive token generation

InternalServerException:

Error thrown when an internal server error occurs

HTTP Status Code: 500 Internal Server Error

Used for unexpected server-side errors that prevent request processing.

ValidationException:

Error thrown when request validation fails

HTTP Status Code: 400 Bad Request

Used for request validation errors such as malformed parameters, missing required fields, or invalid parameter values.

AccessDeniedException:

Error thrown for access denied scenarios with flexible HTTP status mapping

Runtime HTTP Status Code Mapping:

• HTTP 401 (Unauthorized): TOKEN_EXPIRED, AUTHCODE_EXPIRED
• HTTP 403 (Forbidden): USER_CREDENTIALS_CHANGED, INSUFFICIENT_PERMISSIONS

The specific HTTP status code is determined at runtime based on the error enum value. Consumers should use the error field to determine the specific access denial reason.

DeleteConsoleAuthorizationConfiguration

$result = $client->deleteConsoleAuthorizationConfiguration([/* ... */]);
$promise = $client->deleteConsoleAuthorizationConfigurationAsync([/* ... */]);

Delete console authorization configuration with automatic scope detection

Parameter Syntax

$result = $client->deleteConsoleAuthorizationConfiguration([
    'targetId' => '<string>',
]);

Parameter Details

Result Syntax

[
    'consoleAuthorizationEnabled' => true || false,
    'scope' => '<string>',
    'targetId' => '<string>',
]

Result Details

Errors

TooManyRequestsError:

Error thrown when rate limit is exceeded

HTTP Status Code: 429 Too Many Requests

Possible OAuth2ErrorCode values:

• INVALID_REQUEST: Rate limiting, too many requests, abuse prevention

Possible causes:

• Too many token requests from the same client
• Rate limiting based on client_id or IP address
• Abuse prevention mechanisms triggered
• Service protection against excessive token generation

ResourceNotFoundException:

Error thrown when requested resource is not found

HTTP Status Code: 404 Not Found

Used when the specified resource does not exist

InternalServerException:

Error thrown when an internal server error occurs

HTTP Status Code: 500 Internal Server Error

Used for unexpected server-side errors that prevent request processing.

ValidationException:

Error thrown when request validation fails

HTTP Status Code: 400 Bad Request

Used for request validation errors such as malformed parameters, missing required fields, or invalid parameter values.

AccessDeniedException:

Error thrown for access denied scenarios with flexible HTTP status mapping

Runtime HTTP Status Code Mapping:

• HTTP 401 (Unauthorized): TOKEN_EXPIRED, AUTHCODE_EXPIRED
• HTTP 403 (Forbidden): USER_CREDENTIALS_CHANGED, INSUFFICIENT_PERMISSIONS

The specific HTTP status code is determined at runtime based on the error enum value. Consumers should use the error field to determine the specific access denial reason.

DeleteResourcePermissionStatement

$result = $client->deleteResourcePermissionStatement([/* ... */]);
$promise = $client->deleteResourcePermissionStatementAsync([/* ... */]);

Remove a permission statement from the account's SignIn resource-based policy

Parameter Syntax

$result = $client->deleteResourcePermissionStatement([
    'clientToken' => '<string>',
    'statementId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

TooManyRequestsError:

Error thrown when rate limit is exceeded

HTTP Status Code: 429 Too Many Requests

Possible OAuth2ErrorCode values:

• INVALID_REQUEST: Rate limiting, too many requests, abuse prevention

Possible causes:

• Too many token requests from the same client
• Rate limiting based on client_id or IP address
• Abuse prevention mechanisms triggered
• Service protection against excessive token generation

ResourceNotFoundException:

Error thrown when requested resource is not found

HTTP Status Code: 404 Not Found

Used when the specified resource does not exist

InternalServerException:

Error thrown when an internal server error occurs

HTTP Status Code: 500 Internal Server Error

Used for unexpected server-side errors that prevent request processing.

ValidationException:

Error thrown when request validation fails

HTTP Status Code: 400 Bad Request

Used for request validation errors such as malformed parameters, missing required fields, or invalid parameter values.

AccessDeniedException:

Error thrown for access denied scenarios with flexible HTTP status mapping

Runtime HTTP Status Code Mapping:

• HTTP 401 (Unauthorized): TOKEN_EXPIRED, AUTHCODE_EXPIRED
• HTTP 403 (Forbidden): USER_CREDENTIALS_CHANGED, INSUFFICIENT_PERMISSIONS

The specific HTTP status code is determined at runtime based on the error enum value. Consumers should use the error field to determine the specific access denial reason.

GetConsoleAuthorizationConfiguration

$result = $client->getConsoleAuthorizationConfiguration([/* ... */]);
$promise = $client->getConsoleAuthorizationConfigurationAsync([/* ... */]);

Get console authorization configuration with automatic scope detection

Parameter Syntax

$result = $client->getConsoleAuthorizationConfiguration([
    'targetId' => '<string>',
]);

Parameter Details

Result Syntax

[
    'consoleAuthorizationEnabled' => true || false,
    'scope' => '<string>',
    'targetId' => '<string>',
]

Result Details

Errors

TooManyRequestsError:

Error thrown when rate limit is exceeded

HTTP Status Code: 429 Too Many Requests

Possible OAuth2ErrorCode values:

• INVALID_REQUEST: Rate limiting, too many requests, abuse prevention

Possible causes:

• Too many token requests from the same client
• Rate limiting based on client_id or IP address
• Abuse prevention mechanisms triggered
• Service protection against excessive token generation

ResourceNotFoundException:

Error thrown when requested resource is not found

HTTP Status Code: 404 Not Found

Used when the specified resource does not exist

InternalServerException:

Error thrown when an internal server error occurs

HTTP Status Code: 500 Internal Server Error

Used for unexpected server-side errors that prevent request processing.

ValidationException:

Error thrown when request validation fails

HTTP Status Code: 400 Bad Request

Used for request validation errors such as malformed parameters, missing required fields, or invalid parameter values.

AccessDeniedException:

Error thrown for access denied scenarios with flexible HTTP status mapping

Runtime HTTP Status Code Mapping:

• HTTP 401 (Unauthorized): TOKEN_EXPIRED, AUTHCODE_EXPIRED
• HTTP 403 (Forbidden): USER_CREDENTIALS_CHANGED, INSUFFICIENT_PERMISSIONS

The specific HTTP status code is determined at runtime based on the error enum value. Consumers should use the error field to determine the specific access denial reason.

GetResourcePolicy

$result = $client->getResourcePolicy([/* ... */]);
$promise = $client->getResourcePolicyAsync([/* ... */]);

Retrieve the account's consolidated SignIn resource-based policy

Parameter Syntax

$result = $client->getResourcePolicy([
]);

Parameter Details

Result Syntax

[
    'signinResourceBasedPolicy' => [
        'statement' => [
            [
                'action' => ['<string>', ...],
                'condition' => [
                    '<ConditionType>' => [
                        '<String>' => ['<string>', ...],
                        // ...
                    ],
                    // ...
                ],
                'effect' => '<string>',
                'principal' => ['<string>', ...],
                'resource' => '<string>',
            ],
            // ...
        ],
        'version' => '<string>',
    ],
]

Result Details

Errors

TooManyRequestsError:

Error thrown when rate limit is exceeded

HTTP Status Code: 429 Too Many Requests

Possible OAuth2ErrorCode values:

• INVALID_REQUEST: Rate limiting, too many requests, abuse prevention

Possible causes:

• Too many token requests from the same client
• Rate limiting based on client_id or IP address
• Abuse prevention mechanisms triggered
• Service protection against excessive token generation

ResourceNotFoundException:

Error thrown when requested resource is not found

HTTP Status Code: 404 Not Found

Used when the specified resource does not exist

InternalServerException:

Error thrown when an internal server error occurs

HTTP Status Code: 500 Internal Server Error

Used for unexpected server-side errors that prevent request processing.

AccessDeniedException:

Error thrown for access denied scenarios with flexible HTTP status mapping

Runtime HTTP Status Code Mapping:

• HTTP 401 (Unauthorized): TOKEN_EXPIRED, AUTHCODE_EXPIRED
• HTTP 403 (Forbidden): USER_CREDENTIALS_CHANGED, INSUFFICIENT_PERMISSIONS

The specific HTTP status code is determined at runtime based on the error enum value. Consumers should use the error field to determine the specific access denial reason.

IntrospectOAuth2TokenWithIAM

$result = $client->introspectOAuth2TokenWithIAM([/* ... */]);
$promise = $client->introspectOAuth2TokenWithIAMAsync([/* ... */]);

Grants permission to inspect the metadata and state of an OAuth 2.0 access token or refresh token

Implements RFC 7662 OAuth 2.0 Token Introspection over a SigV4-authenticated endpoint. Inspects the metadata of an access_token or refresh_token issued by AWS Sign-In and returns the claims associated with it.

Inactive token semantics (RFC 7662 §2.2): when the supplied token is unknown, expired, revoked, malformed, or owned by a different account, the response body is exactly { "active": false } with all other claims omitted.

Parameter Syntax

$result = $client->introspectOAuth2TokenWithIAM([
    'token' => '<string>', // REQUIRED
    'tokenTypeHint' => '<string>',
]);

Parameter Details

Result Syntax

[
    'accountId' => '<string>',
    'active' => true || false,
    'aud' => '<string>',
    'clientId' => '<string>',
    'exp' => <integer>,
    'iat' => <integer>,
    'iss' => '<string>',
    'jti' => '<string>',
    'nbf' => <integer>,
    'resource' => '<string>',
    'signinSession' => '<string>',
    'sub' => '<string>',
    'tokenType' => '<string>',
    'userId' => '<string>',
]

Result Details

Errors

TooManyRequestsError:

Error thrown when rate limit is exceeded

HTTP Status Code: 429 Too Many Requests

Possible OAuth2ErrorCode values:

• INVALID_REQUEST: Rate limiting, too many requests, abuse prevention

Possible causes:

• Too many token requests from the same client
• Rate limiting based on client_id or IP address
• Abuse prevention mechanisms triggered
• Service protection against excessive token generation

InternalServerException:

Error thrown when an internal server error occurs

HTTP Status Code: 500 Internal Server Error

Used for unexpected server-side errors that prevent request processing.

ValidationException:

Error thrown when request validation fails

HTTP Status Code: 400 Bad Request

Used for request validation errors such as malformed parameters, missing required fields, or invalid parameter values.

AccessDeniedException:

Error thrown for access denied scenarios with flexible HTTP status mapping

Runtime HTTP Status Code Mapping:

• HTTP 401 (Unauthorized): TOKEN_EXPIRED, AUTHCODE_EXPIRED
• HTTP 403 (Forbidden): USER_CREDENTIALS_CHANGED, INSUFFICIENT_PERMISSIONS

The specific HTTP status code is determined at runtime based on the error enum value. Consumers should use the error field to determine the specific access denial reason.

ListResourcePermissionStatements

$result = $client->listResourcePermissionStatements([/* ... */]);
$promise = $client->listResourcePermissionStatementsAsync([/* ... */]);

Retrieve all permission statements in the account's SignIn resource-based policy

Parameter Syntax

$result = $client->listResourcePermissionStatements([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'nextToken' => '<string>',
    'permissionStatements' => [
        [
            'condition' => [
                '<ConditionType>' => [
                    '<String>' => ['<string>', ...],
                    // ...
                ],
                // ...
            ],
            'sid' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

TooManyRequestsError:

Error thrown when rate limit is exceeded

HTTP Status Code: 429 Too Many Requests

Possible OAuth2ErrorCode values:

• INVALID_REQUEST: Rate limiting, too many requests, abuse prevention

Possible causes:

• Too many token requests from the same client
• Rate limiting based on client_id or IP address
• Abuse prevention mechanisms triggered
• Service protection against excessive token generation

ResourceNotFoundException:

Error thrown when requested resource is not found

HTTP Status Code: 404 Not Found

Used when the specified resource does not exist

InternalServerException:

Error thrown when an internal server error occurs

HTTP Status Code: 500 Internal Server Error

Used for unexpected server-side errors that prevent request processing.

ValidationException:

Error thrown when request validation fails

HTTP Status Code: 400 Bad Request

Used for request validation errors such as malformed parameters, missing required fields, or invalid parameter values.

AccessDeniedException:

Error thrown for access denied scenarios with flexible HTTP status mapping

Runtime HTTP Status Code Mapping:

• HTTP 401 (Unauthorized): TOKEN_EXPIRED, AUTHCODE_EXPIRED
• HTTP 403 (Forbidden): USER_CREDENTIALS_CHANGED, INSUFFICIENT_PERMISSIONS

The specific HTTP status code is determined at runtime based on the error enum value. Consumers should use the error field to determine the specific access denial reason.

PutConsoleAuthorizationConfiguration

$result = $client->putConsoleAuthorizationConfiguration([/* ... */]);
$promise = $client->putConsoleAuthorizationConfigurationAsync([/* ... */]);

Enable console authorization configuration with automatic scope detection

Parameter Syntax

$result = $client->putConsoleAuthorizationConfiguration([
    'targetId' => '<string>',
]);

Parameter Details

Result Syntax

[
    'consoleAuthorizationEnabled' => true || false,
    'scope' => '<string>',
    'targetId' => '<string>',
]

Result Details

Errors

TooManyRequestsError:

Error thrown when rate limit is exceeded

HTTP Status Code: 429 Too Many Requests

Possible OAuth2ErrorCode values:

• INVALID_REQUEST: Rate limiting, too many requests, abuse prevention

Possible causes:

• Too many token requests from the same client
• Rate limiting based on client_id or IP address
• Abuse prevention mechanisms triggered
• Service protection against excessive token generation

ConflictException:

Error thrown when request conflicts with current state

HTTP Status Code: 409 Conflict

Used when the request conflicts with the current state of the resource

ResourceNotFoundException:

Error thrown when requested resource is not found

HTTP Status Code: 404 Not Found

Used when the specified resource does not exist

InternalServerException:

Error thrown when an internal server error occurs

HTTP Status Code: 500 Internal Server Error

Used for unexpected server-side errors that prevent request processing.

ValidationException:

Error thrown when request validation fails

HTTP Status Code: 400 Bad Request

Used for request validation errors such as malformed parameters, missing required fields, or invalid parameter values.

AccessDeniedException:

Error thrown for access denied scenarios with flexible HTTP status mapping

Runtime HTTP Status Code Mapping:

• HTTP 401 (Unauthorized): TOKEN_EXPIRED, AUTHCODE_EXPIRED
• HTTP 403 (Forbidden): USER_CREDENTIALS_CHANGED, INSUFFICIENT_PERMISSIONS

The specific HTTP status code is determined at runtime based on the error enum value. Consumers should use the error field to determine the specific access denial reason.

PutResourcePermissionStatement

$result = $client->putResourcePermissionStatement([/* ... */]);
$promise = $client->putResourcePermissionStatementAsync([/* ... */]);

Create a permission statement in the account's SignIn resource-based policy

Parameter Syntax

$result = $client->putResourcePermissionStatement([
    'clientToken' => '<string>',
    'consoleSourceVpce' => '<string>',
    'excludedPrincipal' => '<string>',
    'requestedRegion' => '<string>',
    'signinSourceVpce' => '<string>',
    'sourceIp' => '<string>',
    'sourceVpc' => '<string>',
    'vpcSourceIp' => '<string>',
]);

Parameter Details

Result Syntax

[
    'statementId' => '<string>',
]

Result Details

Errors

TooManyRequestsError:

Error thrown when rate limit is exceeded

HTTP Status Code: 429 Too Many Requests

Possible OAuth2ErrorCode values:

• INVALID_REQUEST: Rate limiting, too many requests, abuse prevention

Possible causes:

• Too many token requests from the same client
• Rate limiting based on client_id or IP address
• Abuse prevention mechanisms triggered
• Service protection against excessive token generation

ConflictException:

Error thrown when request conflicts with current state

HTTP Status Code: 409 Conflict

Used when the request conflicts with the current state of the resource

ServiceQuotaExceededException:

Error thrown when service quota is exceeded

HTTP Status Code: 402 Payment Required (used as quota exceeded indicator)

Used when the request would cause a service quota to be exceeded

InternalServerException:

Error thrown when an internal server error occurs

HTTP Status Code: 500 Internal Server Error

Used for unexpected server-side errors that prevent request processing.

ValidationException:

Error thrown when request validation fails

HTTP Status Code: 400 Bad Request

Used for request validation errors such as malformed parameters, missing required fields, or invalid parameter values.

AccessDeniedException:

Error thrown for access denied scenarios with flexible HTTP status mapping

Runtime HTTP Status Code Mapping:

• HTTP 401 (Unauthorized): TOKEN_EXPIRED, AUTHCODE_EXPIRED
• HTTP 403 (Forbidden): USER_CREDENTIALS_CHANGED, INSUFFICIENT_PERMISSIONS

The specific HTTP status code is determined at runtime based on the error enum value. Consumers should use the error field to determine the specific access denial reason.

RevokeOAuth2TokenWithIAM

$result = $client->revokeOAuth2TokenWithIAM([/* ... */]);
$promise = $client->revokeOAuth2TokenWithIAMAsync([/* ... */]);

Grants permission to revoke an OAuth 2.0 refresh token and its associated refresh tokens

Revokes a refresh_token issued by AWS Sign-In, invalidating the entire token chain so that the refresh_token can no longer be used to mint new access_tokens.

Idempotency: revoking an already-revoked, expired, or otherwise invalid token still returns 200 OK with an empty body. Only the refresh_token type is accepted.

Parameter Syntax

$result = $client->revokeOAuth2TokenWithIAM([
    'token' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

TooManyRequestsError:

Error thrown when rate limit is exceeded

HTTP Status Code: 429 Too Many Requests

Possible OAuth2ErrorCode values:

• INVALID_REQUEST: Rate limiting, too many requests, abuse prevention

Possible causes:

• Too many token requests from the same client
• Rate limiting based on client_id or IP address
• Abuse prevention mechanisms triggered
• Service protection against excessive token generation

InternalServerException:

Error thrown when an internal server error occurs

HTTP Status Code: 500 Internal Server Error

Used for unexpected server-side errors that prevent request processing.

ValidationException:

Error thrown when request validation fails

HTTP Status Code: 400 Bad Request

Used for request validation errors such as malformed parameters, missing required fields, or invalid parameter values.

AccessDeniedException:

Error thrown for access denied scenarios with flexible HTTP status mapping

Runtime HTTP Status Code Mapping:

• HTTP 401 (Unauthorized): TOKEN_EXPIRED, AUTHCODE_EXPIRED
• HTTP 403 (Forbidden): USER_CREDENTIALS_CHANGED, INSUFFICIENT_PERMISSIONS

The specific HTTP status code is determined at runtime based on the error enum value. Consumers should use the error field to determine the specific access denial reason.