o_auth2_tokens

Creates, updates, deletes, gets or lists an o_auth2_tokens resource.

Overview

Name	o_auth2_tokens
Type	Resource
Id	aws.signin.o_auth2_tokens

Fields

The following fields are returned by SELECT queries:

SELECT not supported for this resource, use SHOW METHODS to view available operations for the resource.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
create_o_auth2_token	insert	region, tokenInput		CreateOAuth2Token API Path: /v1/token Request Method: POST Content-Type: application/json or application/x-www-form-urlencoded This API implements OAuth 2.0 flows for AWS Sign-In CLI clients, supporting both: Authorization code redemption (grant_type=authorization_code) - NOT idempotent Token refresh (grant_type=refresh_token) - Idempotent within token validity window The operation behavior is determined by the grant_type parameter in the request body: Authorization Code Flow (NOT Idempotent): JSON or form-encoded body with client_id, grant_type=authorization_code, code, redirect_uri, code_verifier Returns access_token, token_type, expires_in, refresh_token, and id_token Each authorization code can only be used ONCE for security (prevents replay attacks) Token Refresh Flow (Idempotent): JSON or form-encoded body with client_id, grant_type=refresh_token, refresh_token Returns access_token, token_type, expires_in, and refresh_token (no id_token) Multiple calls with same refresh_token return consistent results within validity window Authentication and authorization: Confidential clients: sigv4 signing required with signin:ExchangeToken permissions CLI clients (public): authn/authz skipped based on client_id & grant_type Note: This operation cannot be marked as @idempotent because it handles both idempotent (token refresh) and non-idempotent (auth code redemption) flows in a single endpoint.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

INSERT examples

create_o_auth2_token

CreateOAuth2Token API Path: /v1/token Request Method: POST Content-Type: application/json or application/x-www-form-urlencoded This API implements OAuth 2.0 flows for AWS Sign-In CLI clients, supporting both: Authorization code redemption (grant_type=authorization_code) - NOT idempotent Token refresh (grant_type=refresh_token) - Idempotent within token validity window The operation behavior is determined by the grant_type parameter in the request body: Authorization Code Flow (NOT Idempotent): JSON or form-encoded body with client_id, grant_type=authorization_code, code, redirect_uri, code_verifier Returns access_token, token_type, expires_in, refresh_token, and id_token Each authorization code can only be used ONCE for security (prevents replay attacks) Token Refresh Flow (Idempotent): JSON or form-encoded body with client_id, grant_type=refresh_token, refresh_token Returns access_token, token_type, expires_in, and refresh_token (no id_token) Multiple calls with same refresh_token return consistent results within validity window Authentication and authorization: Confidential clients: sigv4 signing required with signin:ExchangeToken permissions CLI clients (public): authn/authz skipped based on client_id & grant_type Note: This operation cannot be marked as @idempotent because it handles both idempotent (token refresh) and non-idempotent (auth code redemption) flows in a single endpoint.

INSERT INTO aws.signin.o_auth2_tokens (
tokenInput,
region
)
SELECT 
'{{ tokenInput }}' /* required */,
'{{ region }}'
RETURNING
token_output
;

Manifest

# Description fields are for documentation purposes
- name: o_auth2_tokens
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the o_auth2_tokens resource.
  - name: tokenInput
    description: |
      Request body payload for CreateOAuth2Token operation The operation type is determined by the grant_type parameter: grant_type=authorization_code: Requires code, redirect_uri, code_verifier grant_type=refresh_token: Requires refresh_token
    value:
      clientId: "{{ clientId }}"
      grantType: "{{ grantType }}"
      code: "{{ code }}"
      redirectUri: "{{ redirectUri }}"
      codeVerifier: "{{ codeVerifier }}"
      refreshToken: "{{ refreshToken }}"