Skip to main content

​
Endpoint

POST /oauth/token Once you have a verification code, use this endpoint to login the user with their phone number/email and verification code.

​
Remarks

  • The grant_type should be http://auth0.com/oauth/grant-type/passwordless/otp.
  • The client_id of your application is required.
  • The username is either the user’s phone number (if realm=sms) or the user’s email (if realm=email).
  • The realm must be either sms or email, matching the POST /passwordless/start request.
  • The otp should be the user’s verification code.
  • The redirect_uri is a required callback URL that must be registered in your application’s Allowed Callback URLs.

​
Learn More

​
Headers

​
string
A DPoP proof for the request. This is optional and only required if your application uses Demonstrating Proof-of-Possession.

​
Body Parameters

​
string
required
Should be http://auth0.com/oauth/grant-type/passwordless/otp.
​
string
required
The client_id of your application.
​
string
The client_secret of your application. Required for Regular Web Applications only.
​
string
required
The user’s verification code.
​
string
required
Should match the connection used.Allowed values: email, sms
​
string
required
The user’s phone number or email.
​
string
API Identifier of the API for which you want to get an Access Token.
​
string
The identifier of the target API (resource server) you want to access. Must match an API Identifier registered in your Auth0 tenant. Used as an alternative to audience when the tenant’s Resource Parameter Compatibility Profile is set to compatibility.
​
string
Use openid to get an ID Token.
​
string
required
A callback URL that has been registered with your application’s Allowed Callback URLs.

​
Response Messages