# WorkOS Connect

WorkOS Connect is a unified interface that simplifies authentication and authorization across customers, partners, and external SaaS tools.

Read more about [how Connect integrates with AuthKit here](/authkit/connect).

### userinfo

## User information

Provides information about the [User](/reference/authkit/user) referenced by the access token’s `sub` claim. Which claims are returned depends on the scopes originally granted when the access token was issued.

This endpoint is authenticated by providing the previously acquired access token in the `Authorization` header.

### refresh-token-grant

### Refresh token grant

Used by WorkOS Connect OAuth Applications to exchange a refresh token for new access tokens and/or ID tokens. The refresh token is provided when the initial `oauth2/authorize` request is made with the `offline_access` scope.

The [access token](reference/workos-connect/token/authorization-code-grant/access-token) and [ID tokens](reference/workos-connect/token/authorization-code-grant/id-token) issued here are the same as those issued for the initial `authorization_code` grant.

### token

## Token

This endpoint is called by WorkOS Connect Applications to get access tokens, ID tokens, and refresh tokens, depending on the `grant_type` provided when requested.

This endpoint is authenticated by providing the WorkOS Application's client ID and client secret in the body of the request.

There are four grant types available:

- [Authorization code](/reference/workos-connect/token/authorization-code-grant)
- [Refresh token](/reference/workos-connect/token/refresh-token-grant)
- [Client credentials](/reference/workos-connect/token/client-credentials-grant)
- [Device code](/reference/workos-connect/cli-auth/device-code-grant)

Each is described in greater detail below.

### client-credentials-grant

### Client credentials grant

Used by WorkOS Connect M2M Applications to exchange the app’s credentials for access tokens.

### access-token

#### Access token

The access token for WorkOS Connect M2M Applications contains the following claims.

### authorization-code-grant

### Authorization code grant

Used by WorkOS Connect OAuth Applications to exchange an authorization code for access tokens, ID tokens, and refresh tokens.

### id-token

#### ID token

The ID token, when requested with the `openid` scope, contains information about the user’s identity, like name and email address.

### access-token

#### Access token

The access token for WorkOS Connect OAuth Applications contains the following claims.

### user-consent-options

## User Consent Options

The `user_consent_options` can take an array of consent options that the user will be required to choose from on AuthKit's OAuth consent screen. The chosen option will then become available as a JWT claim on the issued access token.

These options can be presented as either a flat or grouped set of options.

### Standalone Connect