Obtain an access token and send it on protected requests as Authorization: Bearer <access_token>. Send token requests as application/x-www-form-urlencoded. The default token lifetime in the reviewed configuration is 30 minutes; the effective lifetime depends on deployment configuration.

Supported grants:

• password: username and password; set domain_user=true for domain login. Supply X-OTP as a request parameter when required.
• client_credentials: registered client ID and secret, supplied as form fields or HTTP Basic credentials. The client must have the SERVICE claim.
• adsso: authdata in the query string.
• customauth: session_id in the query string; the remote IP address is also used.
• msgraphsso: access_token in the token parameters.